51

How do you find the parent process of zombie processes?

When the child process is something where the parent is not entirely obvious...

Is there some way to list processes in tree format or something?

Improve this question

4 Answers 4

Reset to default
64

Add the l option to your ps command line. This is the option for long output. The parent process id is one of the additional columns -- labeled PPID.

$ ps l
F   UID   PID  PPID PRI  NI    VSZ   RSS WCHAN  STAT TTY        TIME COMMAND
0   508  3344  4498  18   0   2452  1236 wait   Ss   pts/12     0:00 /bin/sh
0   508  4467 17796  15   0   4664  1572 wait   Ss   pts/5      0:00 -/bin/bash
0   508  4498  4467  15   0  23032 15108 -      S+   pts/5      2:20 emacs -nw
0   508  4532 17796  15   0   4532  1464 wait   Ss   pts/13     0:00 -/bin/bash
0   508  4916 17796  15   0   4664  1648 wait   Ss   pts/7      0:01 -/bin/bash

Another option is the pstree command to show an ascii tree representation of the processes. You'll probably want the -p option to show process ids.

$ pstree -p dharris
screen(17796)─┬─bash(4467)───emacs(4498)───sh(3344)───sh(3345)
              ├─bash(4532)───su(31037)───bash(31041)
              ├─bash(4916)───pstree(26456)
              ├─bash(13547)───su(20442)───bash(20443)
              └─bash(17797)

sshd(25813)───bash(25817)───screen(25870)
Improve this answer
1
  • 9
    Excellent answer. Instead of pstree -p harris, pstree -p $USER would convey the same meaning, and work verbatim .
    – phihag
    Commented Jul 28, 2012 at 13:29
14

FWIW, ps has a "forest" mode that shows multiple trees:

# ps --version
procps version 3.2.8

# ps f
  PID TTY      STAT   TIME COMMAND
 7889 pts/7    Ss     0:00 -bash
 7988 pts/7    R+     0:00  \_ ps f
 2447 pts/0    Ss+    0:00 -bash
 2532 pts/0    S      0:00  \_ /bin/bash /home/robmee01/sync.sh
 2548 pts/0    S      0:00  |   \_ ssh [email protected]
 2533 pts/0    S      0:00  \_ python /home/robmee01/IE2FF.py
 2534 pts/0    S      0:08  \_ x11vnc -usepw -forever
 2535 pts/0    S      2:47  \_ xosview
 2536 pts/0    Sl     0:17  \_ java -jar /work/timesheet/TimeSheet.jar
 2662 pts/0    Sl    18:53  \_ ./firefox-bin

If that doesn't display the process you are looking for, try specifying your username explicitly: ps f -U $USER; this tends to show more processes than plain-old ps.

Personally I use ps fo pid,cmd or to get a forest view with my choice of columns (pid,cmd in this case). You can get a full list of columns with ps L.

Improve this answer
1
  • Perfect, the only option that really works.
    – Felipe
    Commented Jul 26, 2019 at 21:38
1

htop is also good, especially when pressing l on a process name which will show all open files, pipes and urls for a process (requires lsof)

Improve this answer
1
  • htop can also be switched into tree mode.
    – lanoxx
    Commented May 26, 2013 at 20:42
-1

First use top to find out the pid of the zombie process. Then run ps -elf or ps -ef to find the ppid of the zombie.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .