Every time a program runs, the kernel generates a process tied to that program. In simple terms, a process is an active instance of a program in Linux.

The process generated by the kernel is called the ‘Parent Process‘. Processes that originate from or are created by the parent process are referred to as ‘Child Processes‘. A parent process can have multiple child processes, each possessing a unique PID (Process ID) but all sharing the same PPID.

You might also like:

• All You Need To Know About Processes in Linux [Comprehensive Guide]
• 16 Top Command Examples in Linux [Monitor Linux Processes]
• How to Kill Linux Process Using Kill, Pkill and Killall
• How to Find a Process Name Using PID Number in Linux
• Find Top Running Processes by Highest Memory and CPU Usage in Linux

This guide will walk you through different methods for identifying Parent Process IDs (PPIDs) on a Linux system.

What Separates a PID from a PPID?

A program that is actively running in memory is classified as a process. Upon starting, the process receives a unique identification number known as a process ID (PID), which distinguishes it within the system. The process can be referenced anytime using its PID. For instance, terminating a process requires knowledge of its PID beforehand.

In addition to the PID, each process is given a parent process ID (PPID) indicating which process initiated it. Hence, the PPID corresponds to the PID of the parent process.

To illustrate, imagine process 5 with a PID of 5050 launching process 6. Process 6 would then receive its own unique PID, say 6670, while inheriting the PPID of 5050.

Here, process 5 serves as the parent, and process 6 is the child. The child has a distinct PID, yet its PPID matches the parent’s PID (process 5).

A single parent process may spawn numerous child processes, each assigned a unique PID, yet all bearing the same PPID.

How to Locate the Parent Process ID (PPID) in Linux

There are two primary techniques to discover the PPID of a running process in Linux:

• Utilizing the pstree command.
• Employing the ps command.

Determine Linux Process PPID via pstree Command

The pstree command is a terminal utility that visualizes running processes in a tree-like format, offering a clear way to represent process hierarchies. It effectively illustrates parent-child relationships in a structured layout.

Using the -p option, pstree reveals all running parent processes alongside their respective child processes and associated PIDs.

<code>$ pstree -p</code>

From this output, you can identify both the parent and child process IDs.

As an example, let's examine the PPID for Mozilla Firefox and its complete process hierarchy using the following command:

<code>$ pstree -p | grep 'firefox'</code>

In the result, you’ll notice that the PPID of Firefox is 3457, while the rest are PIDs of its child processes.

To extract only the PPID of Firefox without additional output, use the head command with -1 to display just the first line.

<code>$ pstree -p | grep 'firefox' | head -1</code>

Retrieve Linux Process PPID Using ps Command

Another approach to uncovering the PPID of a process is the ps command, a commonly used utility that shows currently active processes on a Linux system.

When combined with the -ef option, the ps command lists all active processes along with detailed information such as the UID, PID, PPID, and more.

<code>$ ps -ef</code>

To filter results and show only the PPID of a specific process, like Firefox, apply the -e option and pipe the output into the grep command as follows:

<code>$ ps -e | grep 'firefox'</code>

Once again, the output confirms that the PPID of Firefox is 3457.

This guide has illustrated how to locate PPIDs of processes operating on a Linux system. Whether you opt for the pstree command or the ps command, both offer effective ways to achieve the same goal.

The above is the detailed content of How to Find Parent Process [Child Processes] PPID in Linux. For more information, please follow other related articles on the PHP Chinese website!