The process created by the kernel is called the "parent process". A process that is forked or spawned from a parent process is called a "child process". A parent process may consist of multiple child processes, each with a unique PID (Process ID) but sharing the same PPID.
In this guide, we explore the various methods you can use to find the parent process ID (PPID) or process on your Linux system.
What is the difference between PID and PPID?
A program loaded into memory and run is called a process. Once started, a process is assigned a unique number, called a process ID (PID), that uniquely identifies it within the system. The process can be referenced at any time using its PID. For example, to kill a process, you must first know its PID.
In addition to the PID, each process is assigned a parent process ID (PPID), showing which process generated it. Therefore, the PPID is the PID of the process's parent.
To illustrate this, let's assume that process 5 with PID 5050 starts process 6. Process 6 will be assigned a unique PID, such as 6670, but will still be assigned PPID 5050.
The parent process here is process 5 and the child process is 6. The child process is assigned a unique PID but the PPID is the same as the parent process's PID (process 5)
A single parent process can start multiple child processes, each child process has a unique PID but all share the same PPID.
Finding the Parent Process ID (PPID) in Linux
There are two main ways to find the PPID of a running process on a Linux system:
Use the pstree command to find the Linux process PPID
The pstree command is a command line tool that displays running processes in the form of a tree, making it a convenient way to display processes in a hierarchy. It displays parent-child relationships in a tree-like hierarchy.
With the -p option, pstree displays all running parent processes and their corresponding child processes and their respective PIDs.
linuxmi@linuxmi /home/linuxmi/www.linuxmi.com ⚡ pstree -p
Display Linux running processes in a tree hierarchy
From the output, we can see the parent process ID and child process ID.
To demonstrate, we will examine the PPID of Mozilla Firefox and the entire process hierarchy using the following command:
linuxmi@linuxmi /home/linuxmi/www.linuxmi.com ⚡ pstree -p | grep 'firefox'
Find the PPID of the Linux process
It can be seen from the output that the PPID of Firefox is 21401, and the rest are the PIDs of the child process.
To display only the PPID of Firefox and skip the rest of the output, pipe the output to the head command to display the first line with -1.
linuxmi@linuxmi /home/linuxmi/www.linuxmi.com ⚡ pstree -p | grep 'firefox' | head -1
Print the PPID of the Linux process
Use the ps command to find the Linux process PPID
Another option to find the PPID of a process is the ps command, which is a widely used command to display the currently running processes on a Linux system.
When used with the -ef option, the ps command lists all running processes and their details, such as UID, PID, PPID, etc.
linuxmi@linuxmi /home/linuxmi/www.linuxmi.com ⚡ ps -ef
List running Linux processes using PID
To narrow down and display the PPID of a specific process, such as Firefox, pass the -e option and pipe the output to the grep command as shown:
linuxmi@linuxmi /home/linuxmi/www.linuxmi.com ⚡ ps -e | grep 'firefox' 21401 ? 00:00:11 firefox
Find Linux process PID
Once again, from the output, you can see that the PPID for Firefox is 21401.
In this guide, we demonstrate how to find the PPID of a running process on a Linux system. You can use the pstree command or the ps command to achieve the same goal.
The above is the detailed content of How to find parent process PPID in Linux?. For more information, please follow other related articles on the PHP Chinese website!
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
