October 12, 2018 – Rage Against the Shell

Tested in debian 8

Sometimes can be useful to know the parent pid of a process for getting info or to kill it. You can use ps with ppid option:

Scenario:

root      1208  0.0 11.0 312388 113172 ?       Ss   Oct10   0:06 /usr/sbin/apache2 -k start
www-data  3915  0.0 11.1 1363796 113332 ?      Sl   06:25   0:05  \_ /usr/sbin/apache2 -k start
www-data  3916  0.0 10.9 1362304 112000 ?      Sl   06:25   0:03  \_ /usr/sbin/apache2 -k start

Getting de ppid knowing the child pid:

~ $ ps -O ppid= -p 3916
  PID       S TTY          TIME COMMAND
 3916  1208 S ?        00:00:03 /usr/sbin/apache2 -k start

Or short format with only pid:

~ $ ps -o ppid= -p 3916
 1208

Or knowing the child name:

~ $ ps -O ppid= -p $(pgrep apache2)
  PID       S TTY          TIME COMMAND
 1208     1 S ?        00:00:06 /usr/sbin/apache2 -k start
 3915  1208 S ?        00:00:05 /usr/sbin/apache2 -k start
 3916  1208 S ?        00:00:04 /usr/sbin/apache2 -k start

And viceversa, knowing the parent pid get pid from all childs:

~ $ ps --ppid=1208 -f
UID        PID  PPID  C STIME TTY          TIME CMD
www-data  3915  1208  0 06:25 ?        00:00:05 /usr/sbin/apache2 -k start
www-data  3916  1208  0 06:25 ?        00:00:04 /usr/sbin/apache2 -k start

Day: October 12, 2018

Getting the parent process pid