How to Find the Parent Process in Linux

In Linux, every program execution results in the kernel creating a process that stores the program‘s execution details in the system‘s memory. This created process is called the "parent process," and any processes derived from it are "child processes." When a program runs, it becomes a process, so we can say a process is a program in execution.

Understanding the parent-child process relationship is crucial when working with Linux. For example, if a child process encounters an issue, it can affect other processes and the system. In such cases, you may need to kill the parent process to stop the continuously running problematic child process. This article explains multiple methods to find the parent process ID (PPID) in Linux.

What is the Difference Between PID and PPID?

Before learning how to find the PPID, it‘s important to understand the difference between PID and PPID.

• PID (Process ID): A unique ID number assigned to each running process by the Linux kernel for identification.

• PPID (Parent Process ID): The PID of the process that started the child process. All child processes have the same PPID but different PIDs.

So if process A starts process B, A is the parent process with the PPID. B is the child process with its own unique PID. But both share the same PPID.

Method 1: Using the pstree Command

The pstree command visually shows running processes as a tree, displaying their parent-child relationships and respective PIDs/PPIDs.

To find the PPID of a process using pstree:

1. Run pstree -p to show all running processes in a tree format along with PIDs.

2. Search for the process you want the PPID for, e.g. using grep.

For example, to find info on the firefox process:

pstree -p | grep firefox

This prints:

      ¦-firefox(3528)-+-firefox(19763)
      ¦              `-3*[{firefox}(19764)] 

Here 3528 is the PPID, and all the other PIDs (19763, 19764) are child processes.

To only print the PPID, pipe the output to head -1:

pstree -p | grep firefox | head -1

Method 2: Using the ps Command

The ps command displays information about running processes parsed from the /proc directory. This allows finding a process‘s PPID and child PIDs.

To find the PPID with ps:

1. Run ps -ef to list details about all processes, including PPID.

2. Grep for the process you want the PPID for.

For example:

ps -ef | grep firefox

This prints details about the firefox process(es), including:

UID        PID  PPID  C STIME TTY          TIME CMD
user     19763  3528  0 09:45 ?        00:00:02 /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -intPrefs 5:50 
user     19764  3528  0 09:45 ?        00:00:00 /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -intPrefs 5:50

Here 3528 is the PPID displayed next to each child process related to firefox.

To only print the PPID do:

ps -e | grep firefox

Which prints:

3528 ?        00:00:02 /usr/lib/firefox/firefox

Using the /proc Directory

In Linux, information about running processes is exposed under the /proc directory. We can use this directly to find PIDs and PPIDs without using commands like ps or pstree which just parse /proc behind the scenes.

Every process has a subdirectory under /proc named after its PID. For example, for PID 3528 there is a /proc/3528 directory.

The /proc/[pid]/status file in each PID directory contains useful information like the PPID.

For example, to find the PPID for firefox PID 3528:

cat /proc/3528/status | grep PPid

This prints:

PPid:   3427

Showing the firefox parent process ID is 3427.

The /proc/[pid]/stat file contains similar info. The 4th field in that file is the PPID.

So to get just the PPID:

cat /proc/3528/stat | awk ‘{print $4}‘

Finding the Parent of a Parent Process

Sometimes you need to go higher up the process tree to find the grandparent process or great-grandparent process etc.

The PPID is itself just another process with its own parent. So you can recursively search higher by taking the PPID and searching for its parent.

For example, if process A spawned process B, which spawned process C:

• A is the parent process of B
• B is the parent process of C
• To find the parent process of A, take A‘s PID and search for its PPID

You can write a simple script to recursively find parents. For example, in Python:

import os

def get_parent_pid(pid):
    return int(os.popen(f"ps -o ppid= -p {pid}").read())

def find_parent_process(pid):
    ppid = get_parent_pid(pid)
    if ppid == 0: # 0 means no parent
        return None 

    print(f"Parent PID of {pid}: {ppid}")

    return find_parent_process(ppid) # Recursive call

So if you pass a PID to this script, it will keep printing the parent processes while traversing up the tree.

Conclusion

Finding parent processes is crucial for monitoring and managing Linux processes. Key points:

• Every process has a unique PID assigned by kernel
• Parent process ID (PPID) = PID of the process that started this one
• All child processes of a parent share the same PPID
• pstree -p shows process tree with PIDs for visualization
• ps -ef lists detailed process info including PPID
• Can directly access /proc/[pid]/status and /proc/[pid]/stat for PID/PPID without using a command
• Recursively traverse process tree to find grandparent processes etc.

Learning to find the parent-child relationships between processes will help you better understand and control Linux processes. Let me know in the comments if you have any other tips for process management!