How to Find Parent Process [Child Processes] PPID in Linux

Every time a program is executed, the kernel creates a process associated with the program. Simply put, a process is a running instance of a program in Linux.

The process created by the kernel is referred to as the ‘Parent Process‘. Processes derived or spawned from the parent process are known as ‘Child Processes‘. A parent process might consist of multiple child processes each having a unique PID (Process ID) but sharing the same PPID.

In this guide, we explore various ways that you can use to find out the Parent Process IDs (PPIDs) or processes on a Linux system.

What’s The Difference Between a PID and PPID?

A program that is loaded into memory and running is known as a process. Once started, the process is given a unique number known as the process ID (PID) that uniquely identifies it in the system. The process can be referred to at any time using its PID. For example, to kill a process, you will have to know its PID first.

In addition to the PID, each process is assigned a parent process ID (PPID) that shows which process spawned it. Thus, the PPID is the PID of the process’s parent.

To put this into context, let’s assume process 5 with a PID of 5050 starts process 6. Process 6 will be assigned a unique PID such as 6670, but will still be given the PPID of 5050.

The parent process here is process 5 and the child process is 6. The child process is assigned a unique PID but the PPID is the same as the PID of the parent process (process 5)

A single parent can start multiple several child processes, each with a unique PID but all sharing the same PPID.

Find Parent Process ID (PPID) in Linux

There are two main approaches to finding the PPID of a running process on a Linux system:

Find Linux Process PPID Using pstree Command

A pstree command is a command-line tool that displays running processes as a tree, which makes for a convenient way of displaying processes in a hierarchy. It shows the parent-child relationship in a tree hierarchy.

With the -p option, the pstree displays all the running parent processes along with their corresponding child processes and respective PIDs.

$ pstree -p

From the output, we can see the parent process IDs along with the child process IDs.

For demonstration, we are going to check the PPID for Mozilla Firefox along with the entire process hierarchy using the following command:

$ pstree -p | grep 'firefox'

From the output, you can see that the PPID of Firefox is 3457 and the rest are PIDs of child processes.

To display only the PPID of Firefox and skip the rest of the output, pipe the output to the head command with -1 to display the first line.

$ pstree -p | grep 'firefox' | head -1

Find Linux Process PPID Using ps Command

The other option for finding the PPID of a process is the ps command, which is a widely used command that displays the currently running processes on a Linux system.

When used with the -ef option, the ps command lists all the running processes along with their details such as the UID, PID, PPID, etc.

$ ps -ef

To narrow it down and display the PPID of a specific process, for example, Firefox, pass the -e option and pipe the output to the grep command as shown.

$ ps -e | grep 'firefox'

Once again, from the output, you can see that the PPID of Firefox is 3457.

In this guide, we have demonstrated how you can find the PPIDs of processes running on a Linux system. You can use either the pstree command or the ps command to arrive at the same goal.