How to Find Parent Process PPID in Linux

Every time a program is executed, the kernel creates a process associated with the program. Simply put, a process is a running instance of a program in Linux.

The process created by the kernel is referred to as the ‘Parent Process‘. Processes derived or spawned from the parent process are known as ‘Child Processes‘. A parent process might consist of multiple child processes each having a unique PID (Process ID) but sharing the same PPID.

In this guide, we explore various ways that you can use to find out the Parent Process IDs (PPIDs) or processes on a Linux system.

What’s The Difference Between a PID and PPID?

A program that is loaded into memory and running is known as a process. Once started, the process is given a unique number known as the process ID (PID) that uniquely identifies it in the system. The process can be referred to at any time using its PID. For example, to kill a process, you will have to know its PID first.

In addition to the PID, each process is assigned a parent process ID (PPID) that shows which process spawned it. Thus, the PPID is the PID of the process’s parent.

To put this into context, let’s assume process 5 with a PID of 5050 starts process 6. Process 6 will be assigned a unique PID such as 6670, but will still be given the PPID of 5050.

The parent process here is process 5 and the child process is 6. The child process is assigned a unique PID but the PPID is the same as the PID of the parent process (process 5)

A single parent can start multiple several child processes, each with a unique PID but all sharing the same PPID.

Find Parent Process ID (PPID) in Linux

There are two main approaches to finding the PPID of a running process on a Linux system:

Find Linux Process PPID Using pstree Command

A pstree command is a command-line tool that displays running processes as a tree, which makes for a convenient way of displaying processes in a hierarchy. It shows the parent-child relationship in a tree hierarchy.

With the -p option, the pstree displays all the running parent processes along with their corresponding child processes and respective PIDs.

$ pstree -p
Show Linux Running Processes in Tree Hierarchy
Show Linux Running Processes in Tree Hierarchy

From the output, we can see the parent process IDs along with the child process IDs.

For demonstration, we are going to check the PPID for Mozilla Firefox along with the entire process hierarchy using the following command:

$ pstree -p | grep 'firefox'
Find PPID of Linux Process
Find the PPID of the Linux Process

From the output, you can see that the PPID of Firefox is 3457 and the rest are PIDs of child processes.

To display only the PPID of Firefox and skip the rest of the output, pipe the output to the head command with -1 to display the first line.

$ pstree -p | grep 'firefox' | head -1
Print PPID of Linux Process
Print PPID of Linux Process

Find Linux Process PPID Using ps Command

The other option for finding the PPID of a process is the ps command, which is a widely used command that displays the currently running processes on a Linux system.

When used with the -ef option, the ps command lists all the running processes along with their details such as the UID, PID, PPID, etc.

$ ps -ef
List Running Linux Processes with PID
List Running Linux Processes with PID

To narrow it down and display the PPID of a specific process, for example, Firefox, pass the -e option and pipe the output to the grep command as shown.

$ ps -e | grep 'firefox'
Find Linux Process PID
Find Linux Process PID

Once again, from the output, you can see that the PPID of Firefox is 3457.

In this guide, we have demonstrated how you can find the PPIDs of processes running on a Linux system. You can use either the pstree command or the ps command to arrive at the same goal.

Winnie Ondara
My name is Winnie, a Linux enthusiast and passionate tech writer in Linux and DevOPs topics. I enjoy keeping abreast with the latest technologies in the Linux ecosystem and trying out new tools provided by the FOSS community.

Each tutorial at TecMint is created by a team of experienced Linux system administrators so that it meets our high-quality standards.

Join the TecMint Weekly Newsletter (More Than 156,129 Linux Enthusiasts Have Subscribed)
Was this article helpful? Please add a comment or buy me a coffee to show your appreciation.

Got something to say? Join the discussion.

Thank you for taking the time to share your thoughts with us. We appreciate your decision to leave a comment and value your contribution to the discussion. It's important to note that we moderate all comments in accordance with our comment policy to ensure a respectful and constructive conversation.

Rest assured that your email address will remain private and will not be published or shared with anyone. We prioritize the privacy and security of our users.