Home Linux Commands How To Find Parent Process ID (PPID) In Linux: A Step-by-Step Guide

How To Find Parent Process ID (PPID) In Linux: A Step-by-Step Guide

Linux Essentials: Discover Parent Process IDs with ps and pstree Commands

By sk
Published: Updated: 3.1K views

This tutorial will show you how to find the Parent Process ID (PPID) of processes from command line using the ps and pstree commands in Linux and Unix-like operating systems with examples.

This guide will cover methods for discovering the PPIDs of:

  1. A specific process: Find the PPID of a particular program you're curious about.
  2. All processes: Discover the PPID of every running process on your system.
  3. The current process: Identify the PPID of your own shell session.

Benefits of PPID

Knowing the parent process ID (PPID) of a process in Linux can be useful in various scenarios, especially for system administration, troubleshooting, and understanding system behavior.

The Parent Process ID (PPID) in Linux is useful for:

  • Analyzing process hierarchies to understand application and service behaviors.
  • Identifying orphan processes that may consume resources or behave unpredictably after their parent process exits.
  • Managing process trees, allowing for the targeted termination of groups of related processes.
  • Debugging and development, particularly for troubleshooting and managing child processes within applications.
  • Security analysis, helping to trace suspicious processes back to their origins and understand malware behavior.
  • Performance monitoring and optimization, by identifying resource-intensive processes and their origins.

Let us get started!

Find Parent Process ID (PPID) of a Specific Process in Linux

There are a few ways to find the parent process ID (PID) of a given process in Linux from the command line. One common way is by using the ps command, which stands for "process status".

This command is used to display information about active processes. Let us see how to find the PPID of a process with ps command.

1. Open a Terminal: First, you need to open a terminal window. You can do this by searching for "Terminal" in your applications menu or by using a shortcut, which is often Ctrl+Alt+T.

2. Find the PID of Your Process: Before finding the parent PID, you need to know the PID of your process. You can find this by using the ps command combined with grep.

For example, if you're looking for the PID of a process named bash, you would use:

$ ps -aux | grep bash

This command lists all active processes, then filters the list to only show lines containing "bash". The output will show several columns; the second one lists PIDs.

ostechn+   86631  0.0  0.0   8184  5136 pts/0    Ss   17:55   0:00 bash
ostechn+   87430  0.0  0.0   6240   652 pts/0    S+   18:00   0:00 grep bash

The command ps -aux | grep bash is commonly used to list processes and filter out those related to the "bash" shell. However, there's a more elegant way to achieve this without including the grep process itself in the results. Here are a couple of alternatives:

Using egrep with square brackets:

$ ps aux | egrep '[b]ash'

This will match lines containing "bash" but exclude the actual "grep" process from the results.

Sample Output:

ostechn+   86631  0.0  0.0   8184  5136 pts/0    Ss   17:55   0:00 bash

Using pgrep (a more reliable approach):

$ pgrep bash
86631

Unlike ps aux, pgrep directly looks for process names and is less prone to including the grep process in the output.

Remember that these methods are more simple and avoid cluttering your results with the grep process itself.

3. Display the Parent PID: Once you have the PID of your process, you can find its parent PID (PPID) by using the ps command with specific options.

As you can see in the previous command's output, the PID of bash process is 86631.

Now, you can display the parent process ID of bash process using the following command:

$ ps -o ppid= -p 86631

Here, -o ppid= tells ps to only display the parent PID of the process, without headers, and -p 86631 specifies the PID of the process you're interested in. Replace 86631 with the actual PID of your process.

Display Parent Process ID (PPID) of a Given Process
Display Parent Process ID (PPID) of a Given Process

As per the above output, 86624 is the Parent Process ID (PPID) of the bash process.

This method is straightforward and works well for finding the parent PID of a given process in Linux. Remember to replace bash with the actual process name you're interested in, and use the correct PID you find in your initial search.

Print PPIDs of all Processes

If you want to display the PPID's of all processes in your Linux box, you would use:

$ ps j

Sample Output:

   PPID     PID    PGID     SID TTY        TPGID STAT   UID   TIME COMMAND
  86624   86631   86631   86631 pts/0      90712 Ss    1000   0:00 bash
  86631   90712   90712   86631 pts/0      90712 R+    1000   0:00 ps j

As you see in the output above, the ps j command displays a job control-oriented format, showing the PPID among other details for all processes. It's a quick way to get a snapshot of process hierarchies.

As per the above output, the PID of bash process is 86631 and its PPID is 86624.

To view the PPID of a specific process, you simply include its PID, like ps j 86631, to see the details including its PPID.

$ ps j 86631
   PPID     PID    PGID     SID TTY        TPGID STAT   UID   TIME COMMAND
  86624   86631   86631   86631 pts/0      93681 Ss    1000   0:00 bash
Print PPIDs of all Processes
Print PPIDs of all Processes

You can filter only the PPIDs using awk command and exclude all other details like below:

$ ps j | awk 'NR>1 {print $1}'
86624
86631
86631

If you're on a BSD system (like on macOS), use ps j | awk 'NR>1 {print $3}' to list the PPIDs of all processes.

View PPID of a Process using pstree Command

The pstree command in Linux is a utility that displays running processes as a tree. This tree structure visually represents the hierarchy of processes, showing parent processes and their child processes in a nested manner.

This hierarchical view makes it easy to understand the relationship between processes, including which processes were spawned by others.

To list the PPID of a given process, say bash, using the pstree command, run:

$ pstree -sg 86631

This command visualizes the tree of parent processes leading to the specified process (e.g., 86631), which is especially useful for understanding process ancestry in a hierarchical view.

systemd(1)───systemd(1697)───gnome-terminal-(86624)───bash(86631)───pstree(94963)

Getting Current Process's PPID

The "current process" in the context of a Unix-like operating system (like Linux) refers to the process that is currently being executed by the shell or terminal you are working in.

Each time you run a command in the terminal, that command is executed as a process. The shell itself is also a process, and when you ask for the "current process," it generally means the shell process in which you're currently operating.

When you're interacting with a shell (like Bash, Zsh, etc.), several environment variables are automatically set, which provide information about the shell and its processes.

Two important variables in this context are:

  • $$: This variable holds the Process ID (PID) of the current shell. It gives you the PID of the process running the shell instance you are currently using.
  • $PPID: This variable holds the Parent Process ID (PPID) of the shell. It tells you the PID of the process that started the current shell. For example, if you opened a terminal window from within a graphical desktop environment, the PPID would likely be the PID of the process associated with the desktop environment or window manager.

To see the PID of your current shell, you would use:

$ echo $$

And to see the PID of the parent process of your current shell, the command would be:

$ echo $PPID

Understanding these concepts is useful for process management, scripting, and system administration tasks.

Understanding Difference Between PID and PPID

We know now how to find the PPID of a given process. You might wonder what is the difference between PID (Process ID) and PPID (Parent Process ID). Let us discuss them.

PID (Process ID):

  • The PID is a unique numerical identifier assigned to each running process in an operating system.
  • It represents an instance of a program or application that is currently executing.
  • PIDs are essential for managing processes, as they allow the system to track and interact with individual processes.
  • When you start a new process (such as running a command in the terminal), the operating system assigns a unique PID to it.
  • PIDs are used for various purposes, including process control, monitoring, and termination.

PPID (Parent Process ID):

  • The PPID refers to the PID of the process that spawned or created another process.
  • In other words, the PPID represents the parent process of a given process.
  • When a new process is created (e.g., by executing a shell command), the system associates it with the PPID of the process that initiated it.
  • The PPID establishes a hierarchical relationship among processes, forming a tree-like structure.
  • For example:
    • If you open a terminal (which becomes a process with a specific PID), the shell process that launched the terminal becomes its PPID.
    • Any processes started within that terminal (such as running commands) inherit the terminal's PID as their PPID.

In summary, PIDs uniquely identify individual processes, while PPIDs indicate the parent-child relationship between processes. Understanding these concepts is crucial for process management and troubleshooting in an operating system.

Conclusion

In this tutorial, we explained how to obtain the Parent Process ID (PPID) for a specific process, the PPIDs for all processes, and the PPID for the current process using the ps and pstree commands in Linux.

We also discussed the difference between PID and the PPID and their importance.

Understanding and knowing the Parent Process ID (PPID) offers useful insights into the hierarchy and relationships between processes in Linux. This knowledge assists in tasks such as troubleshooting, managing resources, and enhancing security.

Related Read:

You May Also Like

Leave a Comment

* By using this form you agree with the storage and handling of your data by this website.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

This website uses cookies to improve your experience. By using this site, we will assume that you're OK with it. Accept Read More