ps axjfIn the Linux world, processes don't just appear out of thin air. Often, starting one program starts other programs. All processes on a Linux system, for instance, ultimately come from init, the mother of all processes, which always has a PID of 1. The ps command can provide you with a text-based representation of this process tree so you can visually see what processes have spawned others. To see the process tree, use the a, u, and x options, used in the previous section, along with the f (the evocatively named ASCII art forest) option. Note Normally you'd see the following columns: PPID PID PGID SID TTY TPGID STAT UID TIME COMMAND In the interests of making the command tree easier to understand, most of the columns you'd actually see with ps axuf have been removed in the following code listing. $ ps axuf PPID PID COMMAND 1 7558 /usr/sbin/gdm 7558 7561 \_/usr/sbin/gdm 7561 7604 \_/usr/X11R6/bin/X :0 7561 8225 \_/bin/sh /usr/bin/startkde 8225 8279 \_/usr/bin/ssh-agent 8225 8341 \_kwrapper ksmserver 1 8316 kdeinit Running... 8316 10842 \_konqueror [kdeinit] --silent 8316 29663 \_quanta 8316 30906 \_/usr/bin/kwrite /home/scott/analysis 8316 17893 \_/usr/lib/opera/9.0-20060206.1/opera 17893 17960 | \_/usr/lib/opera/pluginwrapper 17893 17961 | \_/usr/lib/opera/plugincleaner Note that ps axjf introduces a key new column, PPID. PPID, the Parent Process ID number, is the number of the process that spawned the PID. Armed with the PID or PPID, you can end runaway processes, as you'll see soon in "End a Running Process." |