How do I get the parent process ID of a given child process?
Solution 1
How to get a parent PID (PPID) from a child's process ID (PID) using the command-line
Use ps -o ppid=
- e.g.
ps -o ppid= 2072
returns2061
, which you can easily use in a script etc.ps -o ppid= -C foo
gives the PPID of process with commandfoo
. You can also use the old fashionedps | grep
:ps -eo ppid,comm | grep '[f]oo'
. - Fuller explanation:
ps -f 2072
returnsUID PID PPID C STIME TTY STAT TIME CMD izx 2072 2061 0 07:16 ? S 0:00 /usr/lib/pulseaudio/pulse/gconf-helper
- The
pstree
relation is:pstree -s -p 2072
:init(1)───pulseaudio(2061)───gconf-helper(2072)
Solution 2
Using only shell variable to get parent PID :
echo $PPID
if you need the command from this parent pid:
cat /proc/$PPID/comm
if you need the full command line (with all options):
cat /proc/$PPID/cmdline
Explanation
-
$PPID
is defined by the shell, it's the PID of the parent process - in
/proc/
, you have some dirs with the PID of each processes. Then, if youcat /proc/$PPID/comm
, you echo the command name of the PID
Check man proc
Solution 3
Using pstree
by command name
Using pstree
you can search by the child process name and get the Process ID (PID) along with the parents, grandparents and any children of the child process:
$ pstree -hp | grep sleep
|-cron(763)---cron(795)---sh(839)---display-auto-br(841)---sleep(8414)
In this case sleep
is the child command and it's PID is 8414
. It's parent ID is 841 and is called display-auto-brightness
. The grandparent is a shell (sh
) with a process ID of 839
. The great-grandparent is cron
with a process ID of 795
. The great-great-grandparent is also cron
with a process ID of 763
.
If you want to search by Process ID of sleep
instead of name you can use:
$ pstree -hp | grep 14653
|-cron(763)---cron(795)---sh(839)---display-auto-br(841)---sleep(14653)
Notice the sleep
process ID changed to 14653
. The parent (PID 841) sleeps for 1 minute, wakes up for a split second and then starts a new sleep
command which gets a new process ID. This is another reason why searching for sleep
is easier than searching by process ID.
This code was taken from: Automatically adjust display brightness based on sunrise and sunset and adapted to this question.
To see a nested chain all the way back to boot process use the PID instead of name:
$ pstree -aps 8541
systemd,1 splash fastboot kaslr
└─cron,763 -f
└─cron,795 -f
└─sh,839 -c /usr/local/bin/display-auto-brightness
└─display-auto-br,841 /usr/local/bin/display-auto-brightness
└─sleep,8541 60
Note: Another minute has passed and the sleep command gets a new PID (8541).
Solution 4
ps -efj
can also be used for the same.
For example,
> ps -efj | head
UID PID PPID PGID SID C STIME TTY TIME CMD
root 1 0 1 1 0 Jul01 ? 00:00:13 /sbin/init splash
root 2 0 0 0 0 Jul01 ? 00:00:00 [kthreadd]
root 3 2 0 0 0 Jul01 ? 00:00:02 [ksoftirqd/0]
root 5 2 0 0 0 Jul01 ? 00:00:00 [kworker/0:0H]
root 7 2 0 0 0 Jul01 ? 00:06:44 [rcu_sched]
root 8 2 0 0 0 Jul01 ? 00:00:00 [rcu_bh]
root 9 2 0 0 0 Jul01 ? 00:00:00 [migration/0]
root 10 2 0 0 0 Jul01 ? 00:00:08 [watchdog/0]
root 11 2 0 0 0 Jul01 ? 00:00:08 [watchdog/1]
Related videos on Youtube
cache
Updated on September 18, 2022Comments
-
cache almost 2 years
How to get parent PID from a given child's PID?
I know I can manually check it under
/proc
, I wonder if there is a smart/better way to achieve this in Ubuntu. Note the parent may or may not be killed.Thanks
-
John P over 7 yearsDo you know of a way to make pstree show invocations (command + arguments) without splitting lines? My installation automatically splits lines if I add arguments, even if the result could easily fit on one line. The man page appears to say as much, but doesn't give a reason. My workaround involves extracting PID's from pstree and using
ps -o args ...
on the results, but that has a bit of a smell. -
Olorin over 6 yearsIn your example, this method wouldn't have worked for the cron process with PID 807.
-
WinEunuuchs2Unix over 6 years@Olorin In both examples you could grep on
807
orcron
and the same line would be retruned as well as more children if spawned. But the question was about finding the parent, not all the children. -
Olorin over 6 yearsExactly - how do you find the parent of PID 807 with that output? You can't, becvause it doesn't include the parent of 807.
-
WinEunuuchs2Unix over 6 years@Olorin The parent of cron is systemd which is PID
1
. I don't think you can kill PID 1. -
Olorin over 6 yearsI didn't say anything about killing anything. Just to clarify, now you're claiming that taking the first line of pstree or grepping for the command name will always give the the parent PID?
-
WinEunuuchs2Unix over 6 yearsThe OP question references parent being active / killed. The inclusion of systemd line is for from which PID 1 calls in early boot. The
sleep
command illustrated is actually part of working code designed to wake parent on system resume. I found this method easier than dealing with searching by PID and wanted to share with others. -
Olorin over 6 yearsOk... "The inclusion of systemd line is for from which PID 1 calls in early boot." Couldn't make sense of that. Not sure what the rest has to do with anything I said, but sure.
-
WinEunuuchs2Unix over 6 years@Olorin Sorry I was typing on my cell phone. The change I made was to reveal the parent of
cron
which issystemd
running on PID 1. In other cases you can include the line 1 above thegrep
search string with-B 1
parameter.. The spirit of the answer is to show how much easier and intuitivepstree
and grepping on command name can be. -
Olorin over 6 yearsNope...
-B1
won't cut it either: paste.ubuntu.com/p/BnfQBMSPbM I don't know how useful this answer is if the letter of it doesn't work, whatever be the spirit... and clearly the spirit of it isn't correct either, since getting the PPID from pstree output is not easy or intuitive just by grepping. -
WinEunuuchs2Unix over 6 years@Olorin In your case you do need to use the PID, ie:` $ pstree -ps 1911` results in:
systemd(1)───lightdm(1012)───lightdm(1555)───upstart(1821)───window-stack-br(1911)
. This was stated in izx's answer above though. -
Olorin over 6 yearsExactly. Either the suggestions don't work well, or are already in another answer.
-
Olorin over 6 yearsEven with process name,
ps -o ppid -C sleep
is far better than this hit and miss answer. -
Gregory Arenius over 5 yearsJust something that surprised me: The space after
ppid=
but before the pid seems to be necessary. I got different results if I omitted it. -
Massimo about 5 yearsThis is the best answer. procfs is a kernel API. execute a command and parse the output is a nonsense.
-
RobV about 5 yearsThis is also potentially the most portable,
PPID
is defined as part of the POSIX standard so any POSIX compliant shell should be setting this appropriately. See pubs.opengroup.org/onlinepubs/9699919799/utilities/… -
aderchox almost 4 yearsI did
ps -o ppid=$$
to get the PPID of the current shell. Thanks.