Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do you find the parent process of zombie processes?

When the child process is something where the parent is not entirely obvious...

Is there some way to list processes in tree format or something?

share|improve this question
up vote 45 down vote accepted

Add the l option to your ps command line. This is the option for long output. The parent process id is one of the additional columns -- labeled PPID.

$ ps l
0   508  3344  4498  18   0   2452  1236 wait   Ss   pts/12     0:00 /bin/sh
0   508  4467 17796  15   0   4664  1572 wait   Ss   pts/5      0:00 -/bin/bash
0   508  4498  4467  15   0  23032 15108 -      S+   pts/5      2:20 emacs -nw
0   508  4532 17796  15   0   4532  1464 wait   Ss   pts/13     0:00 -/bin/bash
0   508  4916 17796  15   0   4664  1648 wait   Ss   pts/7      0:01 -/bin/bash

Another option is the pstree command to show an ascii tree representation of the processes. You'll probably want the -p option to show process ids.

$ pstree -p dharris

share|improve this answer
Excellent answer. Instead of pstree -p harris, pstree -p $USER would convey the same meaning, and work verbatim . – phihag Jul 28 '12 at 13:29
+1 for pstree. – void.pointer Mar 21 '15 at 15:59

FWIW, ps has a "forest" mode that shows multiple trees:

# ps --version
procps version 3.2.8

# ps f
 7889 pts/7    Ss     0:00 -bash
 7988 pts/7    R+     0:00  \_ ps f
 2447 pts/0    Ss+    0:00 -bash
 2532 pts/0    S      0:00  \_ /bin/bash /home/robmee01/
 2548 pts/0    S      0:00  |   \_ ssh
 2533 pts/0    S      0:00  \_ python /home/robmee01/
 2534 pts/0    S      0:08  \_ x11vnc -usepw -forever
 2535 pts/0    S      2:47  \_ xosview
 2536 pts/0    Sl     0:17  \_ java -jar /work/timesheet/TimeSheet.jar
 2662 pts/0    Sl    18:53  \_ ./firefox-bin

If that doesn't display the process you are looking for, try specifying your username explicitly: ps f -U $USER; this tends to show more processes than plain-old ps.

Personally I use ps fo pid,cmd or to get a forest view with my choice of columns (pid,cmd in this case). You can get a full list of columns with ps L.

share|improve this answer

htop is also good, especially when pressing l on a process name which will show all open files, pipes and urls for a process (requires lsof)

share|improve this answer
htop can also be switched into tree mode. – lanoxx May 26 '13 at 20:42

First use top to find out the pid of the zombie process. Then run ps -elf or ps -ef to find the ppid of the zombie.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .