Shane Rainville
Posted on

How to find the Parent Process ID in Linux

Overview

In this quick tutorial, you are going to learn how to find the Parent Process ID in Linux from the command-line.

You will also learn how to find the children of a given Parent Process ID using the ps command.

We will also cover how to output a complete process tree of a parent process using the pstree command. A very helpful thing when you want to identify all of the children of a given parent, their IDs and names, which you may need when killing a process.

Parent Process ID Environment Variable

The parent process ID of your current context is exposed as an environment variable. To see the value you can echo it out. 

echo $PPID

For example, if you are SSH‘d into a Linux server, the value of the $PPID environment variable will the process ID of the SSH process.

The environment variable only outputs the process ID. To see what the parent process is we can use the ps command with the $PPID environment variable.

ps -e | grep $PPID

Find the Parent Process ID of a Running Process

To determine the parent process of a specific process, we use the ps command.

ps -o ppid= -p 9801

The output only contain the parent process ID itself. Using the output from the ps command we can determine the name of the process.

ps -e | grep 9801
2029 ?        00:00:14 apache2

Listing Child Processes of a Parent Process ID

With the parent process ID we can lookup all of the child process using of the parent using the pgrep command.

pgrep -laP $PPID

For a typical SSH parent the output will list the following processes

30797 -bash
30798 /usr/lib/openssh/sftp-server

Display Process Tree

Another useful utility is the pstree command. This command will output a tree of children processes of a parent process ID. For example, to display a tree of child processes from the current parent process, you would run the following command.

pstree $PPID
sshd─┬─bash───pstree
     └─sftp-server

From the example above, we can see that the sshd process is our current Parent Process ID (PPID), and that it has two child processes. The child process are bash and sftp-server.

We can also see that the bash process has its own child, which is the pstree command we just executed.

The pstree command can also output the process ID of each process in your tree. To output the process IDs you use the -p flag. Here’s an example of a process tree for an Apache webserver.

pstree -p 2029
apache2(2029)─┬─apache2(9790)
              ├─apache2(9791)
              ├─apache2(9792)
              ├─apache2(9793)
              ├─apache2(9794)
              ├─apache2(9795)
              ├─apache2(9796)
              ├─apache2(9797)
              ├─apache2(9798)
              ├─apache2(9799)
              ├─apache2(9800)
              ├─apache2(9801)
              ├─apache2(9802)
              ├─apache2(9803)
              ├─apache2(9804)
              ├─apache2(9805)
              ├─apache2(9806)
              ├─apache2(9807)
              ├─apache2(9808)
              ├─apache2(9809)
              ├─apache2(9836)
              ├─apache2(9944)
              ├─apache2(15517)
              ├─apache2(21980)
              └─apache2(29107)