Keeping Track of Process Status with ps, pstree, and pgrep

277

Making parent-child relationships stand out in a ps listing

When you’re looking at a long ps listing, it’s difficult to discern the parent-child relationships among processes. ps has two command line options that make that relationship a little easier to see.

The -H option indents child processes; each generation is indented a bit more than the previous generation:

$ ps -AH
PID	TTY	TIME	CMD
1	?	00:00:04	init
4993	?	00:00:00	atd
4647	?	00:00:00	crond
5022	?	00:00:00	dbus-daemon-1
4240	?	00:00:00	dhclient
5045	?	00:00:00	gdm-binary
5175	?	00:00:00	gdm-binary
5176	?	00:07:43	X
5197	?	00:00:00	startkde
5323	?	00:00:00	kwrapper
5256	?	00:00:00	ssh-agent
.... .		........ .................

You can see from this example that the init process (process ID 1) is that ancestor of all the other processes. Process 5175 is the parent of two children (5176 and 5197) and the grandparent of process 5323 and process 5256.

To see a slightly fancier display, use the --forest option instead of -H:

$ ps -AH --forest
PID	TTY	TIME	CMD
1	?	00:00:04	init
4993	?	00:00:00	atd
4647	?	00:00:00	crond
5022	?	00:00:00	dbus-daemon-1
4240	?	00:00:00	dhclient
5045	?	00:00:00	gdm-binary
5175	?	00:00:00	\_ gdm-binary
5176	?	00:07:48	\_ X
5197	?	00:00:00	\_ startkde
5256	?	00:00:00	\_ ssh-agent
5323	?	00:00:00	\_ kwrapper
.... .		........ .................

Personally, we find the --forest option a tad confusing; we prefer the pstree command instead. See the next section for details on pstree.

Climbing the family tree with pstree

pstree is similar to the ps command, but it has far fewer options. When you run pstree, you see a graph of processes running on your system, similar to that shown in Figure 39-1.

• Figure 39-1: Output from the pstree command.

You can see that pstree makes the process tree easy to see. By default, pstree compresses the process tree by removing duplicate branches from the display. You can see all the processes running on your system by including the -c, -a, or -p option:

-c simply disables compression.

-a tells pstree to display the command line arguments for each process, as shown in Figure 39-2.

-p forces pstree to add process IDs to the graph, as shown in Figure 39-3.

You can use the -p and -a options in the same report. The command $ pstree -pa includes in the output the command line arguments for the process as well as the process ID.

278 Technique 39: Controlling Troublesome Processes at the Command Line

• Figure 39-2: pstree -a displays command line arguments.

• Figure 39-3: pstree -p displays process IDs.

pstree has a few more options that you might find useful:

-h highlights your current process and all ancestors (see Figure 39-4), making it easy to find yourself in a complex listing.

-u shows the user name associated with each process. (Actually, -u displays the user name only when it changes from parent to child.)

• Figure 39-4: pstree highlight mode.

If you want to see the descendents of a specific process, include the process ID at the end of the command, like this:

$ pstree 5296

To see the processes for a particular user, include the user name at the end of the command line:

$ pstree freddie

Finding processes with pgrep

ps and pstree are useful tools when you want to see the big picture, but it can be tough to find the process you’re looking for in a long list. That’s where pgrep comes in. pgrep lets you search for specific processes based on a number of process characteristics.

To search for processes running a particular program, run pgrep pattern. For example, here’s how to search for all processes running mozilla:

$ pgrep mozilla 5385 5391 5393 5395

5400

Keeping Track of Process Status with ps, pstree, and pgrep

279

Hmmm . . . that output is a bit terse. Use the -l option to display the program name as well as the process ID:

$ pgrep -l mozilla 5385 run-mozilla.sh 5391 mozilla-bin 5393 mozilla-bin 5395 mozilla-bin 5400 mozilla-bin

pgrep matches program names based on regular expressions (that is, wildcards), so it displays processes whose names include mozilla. For a complete rundown on the regular expression syntax understood by psgrep, see the man page for regex (info regex). If you want an exact match (not a regular expression match), use the -x option. By default, pgrep matches the pattern that you provide against the program name for each process. To match the pattern anywhere in the command line (not just in the program name), include -f on the command line:

$ pgrep -fl mozilla

5385	/usr/ local/mozilla/run-mozilla.sh
5391	/usr/local/mozilla/mozilla-bin
5393	/usr/local/mozilla/mozilla-bin
5395	/usr/local/mozilla/mozilla-bin
5400	/usr/local/mozilla/mozilla-bin
9388	more run-mozilla.sh

Notice process 9388: The program running there is more, but because the command line arguments include mozilla, pgrep displays it.

pgrep can also find processes based on the criteria shown in Table 39-3.

TABLE 39-3: PGREP OPTIONS THAT LOOK FOR MATCHING DATA

Option	Description
-P pid	Selects processes whose parent is
	process pid
-g process-group	Selects processes belonging to
	process group process-group

Option	Description
-s session-ID	Selects processes belonging to the
	login session session-ID
-u user	Selects processes whose effective
	user IDs match user (user can be a
	user name or a numeric user ID)
-U user	Selects processes whose real user
	IDs match user (user can be a user
	name or a numeric user ID)
-G group	Selects processes whose effective
	groups match group (group can be
	a group name or a numeric group ID)
-T terminal	Selects processes associated with
	terminal (or pty) terminal

In addition to the matching options described in Table 39-3, you can negate the criteria with the -v option. For example, to find all the processes not owned by user root, use this command:

$ pgrep -U root -v

You can also tell pgrep to display only the most recent process that matches your criteria. To do so, just include -n on the command line like this:

$ pgrep -n xmms

That’s handy if you want to find the most recently invoked copy of a program.

As explained earlier, pgrep displays a list of process IDs by default, but you may want to see more information. To help pgrep overcome its minimalism, you feed the output from pgrep (the list of processes that match your criteria) into another program that knows how to use a process ID. For example, here’s how to see detailed information about all the processes owned by user freddie or by user franklin:

$ ps -l --pid $(pgrep -U freddie,franklin)

The bash shell first executes the command inside the parentheses and then builds a new command that incorporates the output from pgrep. That might