Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How do you find the parent process of zombie processes?

When the child process is something where the parent is not entirely obvious...

Is there some way to list processes in tree format or something?

share|improve this question

3 Answers 3

up vote 33 down vote accepted

Add the l option to your ps command line. This is the option for long output. The parent process id is one of the additional columns -- labeled PPID.

$ ps l
F   UID   PID  PPID PRI  NI    VSZ   RSS WCHAN  STAT TTY        TIME COMMAND
0   508  3344  4498  18   0   2452  1236 wait   Ss   pts/12     0:00 /bin/sh
0   508  4467 17796  15   0   4664  1572 wait   Ss   pts/5      0:00 -/bin/bash
0   508  4498  4467  15   0  23032 15108 -      S+   pts/5      2:20 emacs -nw
0   508  4532 17796  15   0   4532  1464 wait   Ss   pts/13     0:00 -/bin/bash
0   508  4916 17796  15   0   4664  1648 wait   Ss   pts/7      0:01 -/bin/bash

Another option is the pstree command to show an ascii tree representation of the processes. You'll probably want the -p option to show process ids.

$ pstree -p dharris
screen(17796)─┬─bash(4467)───emacs(4498)───sh(3344)───sh(3345)
              ├─bash(4532)───su(31037)───bash(31041)
              ├─bash(4916)───pstree(26456)
              ├─bash(13547)───su(20442)───bash(20443)
              └─bash(17797)

sshd(25813)───bash(25817)───screen(25870)
share|improve this answer
4  
Excellent answer. Instead of pstree -p harris, pstree -p $USER would convey the same meaning, and work verbatim . –  phihag Jul 28 '12 at 13:29

FWIW, ps has a "forest" mode that shows multiple trees:

# ps --version
procps version 3.2.8

# ps f
  PID TTY      STAT   TIME COMMAND
 7889 pts/7    Ss     0:00 -bash
 7988 pts/7    R+     0:00  \_ ps f
 2447 pts/0    Ss+    0:00 -bash
 2532 pts/0    S      0:00  \_ /bin/bash /home/robmee01/sync.sh
 2548 pts/0    S      0:00  |   \_ ssh usernamer@example.com
 2533 pts/0    S      0:00  \_ python /home/robmee01/IE2FF.py
 2534 pts/0    S      0:08  \_ x11vnc -usepw -forever
 2535 pts/0    S      2:47  \_ xosview
 2536 pts/0    Sl     0:17  \_ java -jar /work/timesheet/TimeSheet.jar
 2662 pts/0    Sl    18:53  \_ ./firefox-bin

If that doesn't display the process you are looking for, try specifying your username explicitly: ps f -U $USER; this tends to show more processes than plain-old ps.

Personally I use ps fo pid,cmd or to get a forest view with my choice of columns (pid,cmd in this case). You can get a full list of columns with ps L.

share|improve this answer

htop is also good, especially when pressing l on a process name which will show all open files, pipes and urls for a process (requires lsof)

share|improve this answer
    
htop can also be switched into tree mode. –  lanoxx May 26 '13 at 20:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.