List child process IDs

Question

I want to get a list of all child process IDs for a given parent process ID (6330 qemu) to use in a bash script.

I can see them in htop, for instance:

Top search results include:

# pgrep -P 6330
(no output)

# ps --ppid 6330
  PID TTY          TIME CMD

# pstree -p 6330
qemu(6330)-+-{qemu}(6332)
           |-{qemu}(6333)
           |-{qemu}(6340)
           |-{qemu}(6342)
           |-{qemu}(6343)
           `-{qemu}(6344)

...output of these are the same if run as root or as the user that owns qemu.

The pstree output is workable as a last resort, but I would prefer not parsing it if I can help it.

Also... ps aux | grep 6332 and pgrep 6332 doesn't yield anything... so that's a little puzzling too.

This should be easy right?

I appreciate your time.

Answer 1

I want to get a list of all child process IDs for a given parent process ID (6330 qemu) to use in a bash script.

The solution to this exact problem is pgrep -P 6330, but the rest of the question suggests maybe "child process IDs" are not what you really want.

You used pgrep -P 6330 and the output was empty because there were no child processes. What htop and pstree showed you were threads. So maybe you really want thread IDs.

See these:

• Why are there many processes listed under the same title in htop?

  htop shows individual threads as separate processes by default, similarly to how ps -AL would. If you press capital H it will switch to only showing the main processes (pressing it again switches back).

• man 1 pstree:

  Child threads of a process are found under the parent process and are shown with the process name in curly braces […]

• Are threads implemented as processes on Linux?

  Linux used to assign different PIDs to threads. Since Linux 2.4 threads of a process share its PID; this is to satisfy POSIX. The terminology got more complicated, "PID" is somewhat ambiguous. From a relevant answer on SO:

  The first and most important thing to realize is that "PID" means different things in kernel space and user space. What the kernel calls PIDs are actually kernel-level thread ids (often called TIDs), […]. Each thread on the system, whether in the same process or a different one, has a unique TID (or "PID" in the kernel's terminology).

  What's considered a PID in the POSIX sense of "process", on the other hand, is called a "thread group ID" or "TGID" in the kernel. Each process consists of one or more threads (kernel processes) each with their own TID (kernel PID), but all sharing the same TGID, which is equal to the TID (kernel PID) of the initial thread in which main runs.

  When top shows you threads, it's showing TIDs (kernel PIDs), not PIDs (kernel TGIDs), and this is why each thread has a separate one.

  The last sentence applies to htop or pstree as well.

If you still want to get these different IDs (6332, 6333, …) to use in a shell script, invoke this:

ps -o lwp= -Lp 6330

The command is not portable, it may or may not work in your OS. If it works, you may want to exclude the main thread:

ps -o lwp= -Lp 6330 | grep -v '^ *6330$'

(<space>* because ps (at least my ps) adds leading spaces).