How Do I Find Parent Process in Linux

During the execution of a program, the kernel creates a process that helps store the program’s execution details in the system’s memory. When a program executes, it becomes a process for the system. So, we can say a process is a program until it executes.

The process created by the kernel is known as the “Parent Process,” and all the processes derived from the parent process are termed as “Child Processes.” A single process may consist of several child processes having a unique PID but with the same PPID.

A question might occur in the beginner’s mind that what’s the difference between PID and PPID?

We have already discussed PID in most of our articles if you’re the new one, no worries!

In Linux systems, several processes are executed at a time. Sometimes, a process may have a single thread (unit of execution within a process) or multiple threads. Processes have different states; they could be in waiting, ready, or in running state. It’s all about how the user or kernel prioritizes them. So, these processes are identified by the unique numbers we call process ID (PID). Unique numbers for the parent processes are called PPIDs, and each parent process can have multiple child processes with their unique process IDs. The PIDs of child processes are different as they represent separate execution units but have the same parent process ID (PPID).

We need PPID when the child process creates some problems and doesn’t work properly. In this case, it can affect the working of other processes, and the system might get affected as well. Here, to stop the process which is running continuously, it is necessary to kill its parent process.

Let’s check how we can find PPID:

How to Find Parent Process ID (PPID) in Linux:

We have a couple of approaches to find the PPID of a running process in Linux systems:

1. Using the “pstree “Command
2. Using the “ps” Command

How to Find PPID using pstree Command in Linux:

The “pstree” command is a good approach to identify the parent process ID (PPID) as it shows the parent-child relationship in a tree hierarchy.

Type the simply “pstree” command with the “-p” option in the terminal to check how it displays all running parent processes along with their child processes and respective PIDs.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/06/echo/1-12.jpg" data-lazy- height="485" src="data:image/svg xml,” width=”927″>

It shows the parent ID along with the child processes IDs.

Let’s check an example of “Mozilla Firefox” to get its PPID along with the complete process hierarchy. Execute the following command in the terminal:

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/06/echo/2-12.jpg" data-lazy- height="272" src="data:image/svg xml,” width=”925″>

(grep is a command-line tool that helps to search for particular string)

In the mentioned results, we can see that 3528 is the PPID of the process “Firefox,” and all others are child processes.

To print only the parent process ID in the terminal, run the mentioned command:

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/06/echo/3-12.jpg" data-lazy- height="77" src="data:image/svg xml,” width=”924″>

How to Find PPID using ps Command:

The “ps” command utility is another way to process information from the “/proc” filesystem and monitor them.

Through this command, the user can also find the PPID and PIDs of a running process.

Run the following “ps” command along with the “ef” option to show detailed information of processes including PPID:

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/06/echo/4-10.jpg" data-lazy- height="246" src="data:image/svg xml,” width=”925″>

If you want to display the PPID of a specific process with details, execute the mentioned “ps” command with the “grep”:

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/06/echo/5-10.jpg" data-lazy- height="336" src="data:image/svg xml,” width=”923″>

(the “-f” option is used to list down the details of the process)

And to get only the PPID of “Firefox,” use the following syntax:

So, find the PPID of “firefox” using the command:

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/06/echo/6-7.jpg" data-lazy- height="78" src="data:image/svg xml,” width=”922″>

Conclusion:

At every execution of a program, the kernel creates a process that loads execution details in memory. This created process is known as the parent process having single or multiple threads. Each process has assigned the unique PPID and PIDs automatically by the kernel.

While working with the Linux system, one should know about the PPIDs of the running processes. An issue with the child process may affect the other processes. In such cases, we may need to kill the parent process.

The PPIDs of running processes can be identified using multiple ways. The simplest approaches are through the “ps” command and “pstree” command.

We have seen above how we can find out the PPID of a specific process using these two command tools.