pstree: Associating Child Processes

Sometimes tracking down which process spawned a child process can be an arduous task, especially when you’ve reached more than 5 parent processes. To alleviate some of that headache Unix/Linux has a command called pstree which will show processes in a tree format.


[[email protected] ~]# pstree  

This is awesome if you are trying to find where a process originally spawned from. Below is a couple of flags I like to add to pstree to make it even more helpful.

-a Show command line arguments. If the command line of a process is swapped out, that process is shown in parentheses. -a implicitly disables compaction for processes but not threads.
-l Display long lines. By default, lines are truncated to the display width or 132 if output is sent to a non-tty or if the display width is unknown.
-p Show PIDs. PIDs are shown as decimal numbers in parentheses after each process name. -p implicitly disables compaction.

Example Output:

[[email protected] ~]# pstree -alp  
 NetworkManager,1108 --pid-file=/var/run/NetworkManager/  
  dhclient,2333 -d -4 -sf /usr/libexec/nm-dhcp-client.action -pf /var/run/ -lf /var/lib/dhclient/ -cf /var/run/nm-dhclient-eth0.conf eth0  
 VBoxClient,1806 --clipboard  
 VBoxClient,1813 --display  
 VBoxClient,1819 --seamless  

About Benjamin

Benjamin is a Infrastructure and Software Engineer. On this blog he writes about Linux, Docker, Programming as well as other Systems topics.

Learn more about Linux

If you liked this article, check out Benjamin's book: Red Hat Enterprise Linux Troubleshooting Guide. Where you can learn a lot more about troubleshooting Linux systems. This book is filled with tips and techniques he has learned over years of managing mission critical systems.