How to Find Parent Process PPID on Linux

If you are looking for a solution on how to find parent process PPID on Linux, here’s everything you need to know. 

There are several reasons you may want to know the parent process of a particular process. Even though you can manually check the process ID using under /proc. However, there are better and more innovative ways to achieve the same thing in Linux. 

In this article, we will discuss different approaches to finding the parent process PID in detail. We will start with a brief introduction to the process. Then, we will discuss the reasons for finding the process PID in Linux. Different approaches to find parent process PPID on Linux are then discussed.

What is a process?

A process is a program in execution. When we execute a program, the kernel creates the appropriate data structure in memory to store the states of the process. A process may create several sub-processes for its operation. 

In that case, there will be a parent process with its process ID and sub-processes with its parent ID. Put in another way, the process created by the kernel is the parent process, and the processes created/spawned from the parent processes are called child processes.

Note that the PID of each child will be different. However, their parent process ID (PPID) will be the same for each sub-processes. The PID of a process can be easily found using the following command:

$pidof exact_process_name

However, the ordeal to find parent process PPID on Linux may get tricky sometimes. So, we will discuss it in detail in this article.

Why do we need PPID?

We need the PPID of a process when a child process starts malfunctioning. In that case, the process may affect other processes, and it is essential to stop it. To stop this process, we must have the information about its parent process ID (PPID). In addition, you should find the PPID of a process to manage or interact with the process.

How to Find Parent Process PPID on Linux

There are different ways to find the PPID in Linux. We will discuss three approaches:

• Using pstree: A pstree is a command line utility that displays the running process as a tree. By analyzing the output of pstree, we can find the PPID of a process
• Using the environment variable: You can also use the environment variables to get a process’ PPID
• Using ps command: The ps command is a well-known command in Linux that can be used to display the currently running process in a system. By investigating the output of the ps command, we can find the PPID of a process

We will now discuss each of these approaches in detail.

Finding PPID using process tree

Using the process tree, we can see the PPID of a child process. The pstree command shows the parent-child relationship amongst processes in a tree. To find parent process PPID on Linux, type the pstree command on the terminal with the –p option. It will show all the processes running on your system, their child process, and their respective PPID. The following command illustrates it:

$ pstree –p

You will get an output similar to the following:

The above command shows the parent ID and the child process IDs. Suppose you want to know the PPID of Mozilla Firefox along with the complete process hierarchy. You can use the following command:

$ pstree -p | grep “firefox”

Here, we have to use the grep command to search, which can be used for searching for a particular string in an input stream. If you want only the process ID in the Terminal, you can use the following command:

$ pstree -p | grep “firefox” | head -1

Using environment variable

Another approach to finding parent process PPID in Linux is using the environment variable. The parent process ID of the current context is exposed in Linux as an environment variable. To see the parent process ID, use the following command:

$echo $PPID

Suppose you have SSHed into a Linux server. Then the parent process ID, i.e., the value of PPID, will be the process ID of the SSH process. In the above command, the output will be the parent process ID. We can get the complete details of the process with the ps command. To see what parent process this process ID represents, the following command can be used:

$ps -e | grep $PPID

After having the parent ID, if you need a command from this process, use the following:

$cat /proc/$PPID/comm

Should you need a full command line with all the options, use the following command:

$cat /proc/$PPID/cmdline

Finding the parent process ID of a running process using the PS command

We can use the ps command to find the parent process of a specific process. The ps command looks for and monitors the information about the process from the /proc files system. The following command can be used:

$ps -o ppid= -p 9801

Once again, the above command will find the process ID of the parent. We can use the ps command again to find the process name as follows:

$ps -e | grep 9801

To know the details information about the process, you can use the following command as well:

$ ps –ef

You will get the following output:

Finding the child processes of a parent process

We end the article with a brief discussion on how to find the child processes of a parent process. For this purpose, we will use the pgrep command as follows:

$pgrep -laP $PPID

In this article, we have discussed various approaches to finding the parent process ID (PPID) of a process in Linux. We discussed various reasons to know the PPID of a process. Then, we discussed three approaches to finding the PPID of a process. We end the article with a discussion on finding child processes of a process.

If this guide helped you, please share it.