Introduction to Linux Process Hierarchy with pstree
In this tutorial, we will delve into the Linux pstree command, a powerful utility for visualizing process relationships within a Linux environment. The pstree command presents a hierarchical, tree-like structure of all running processes, clearly illustrating parent-child dependencies. This is invaluable for systemadmin tasks such as troubleshooting, resource monitoring, and understanding application behavior. We'll cover the fundamentals of pstree, explore process hierarchies, and master filtering and customization techniques.
Understanding the pstree Command
This section focuses on the pstree command and its role in process visualization on Linux. Understanding how processes relate to each other is crucial for any systemadmin.
The pstree command creates a visual representation of running processes, showing the connections between parent and child processes. This is extremely useful for grasping the architecture and dependencies of various processes on your system.
Let's begin by executing the pstree command in your terminal:
$ pstree
systemd─┬─ModemManager─┬─dhclient
│ └─2*[{ModemManager}]
├─NetworkManager─┬─dhclient
│ └─2*[{NetworkManager}]
├─accounts-daemon───2*[{accounts-daemon}]
├─apache2─┬─apache2
│ └─2*[apache2]
├─atd
├─cron
├─dbus-daemon
├─dockerd─┬─containerd─┬─containerd-shim─┬─bash
│ │ │ └─3*[{containerd-shim}]
│ │ └─6*[{containerd}]
│ └─7*[{dockerd}]
├─gdm3─┬─Xorg
│ └─gnome-session-b─┬─gnome-shell
│ ├─ibus-daemon─┬─ibus-engine-sim
│ │ └─2*[{ibus-daemon}]
│ └─2*[{gnome-session-b}]
├─irqbalance
├─kerneloops
├─kube-proxy
├─kubelet
├─lightdm─┬─Xorg
│ └─lightdm───sh───fluxbox
├─lxcfs
├─lxd─┬─lxd
│ └─2*[{lxd}]
├─polkitd───2*[{polkitd}]
├─rsyslogd
├─snapd───10*[{snapd}]
├─ssh-agent
├─systemd-journal
├─systemd-logind
├─systemd-networkd
├─systemd-resolve
├─systemd-timesyn
├─systemd-udevd
├─udisksd───3*[{udisksd}]
├─unattended-upgr───2*[{unattended-upgr}]
├─upowerd───2*[{upowerd}]
├─user-manager───3*[{user-manager}]
└─whoopsie───2*[{whoopsie}]This output displays the process hierarchy, starting with systemd, which is often the root process on modern Linux systems, acting as the parent for numerous other processes.
The pstree command's output can be adjusted using various options. For instance, to view process IDs (PIDs) instead of process names, use the -p option:
$ pstree -p
systemd(1)─┬─ModemManager(577)─┬─dhclient(593)
│ └─2*[{ModemManager}(580,581)]
├─NetworkManager(572)─┬─dhclient(590)
│ └─2*[{NetworkManager}(573,574)]
├─accounts-daemon(531)───2*[{accounts-daemon}(532,533)]
├─apache2(688)─┬─apache2(689)
│ └─2*[apache2(690,691)]
├─atd(544)
├─cron(545)
├─dbus-daemon(530)
├─dockerd(688)─┬─containerd(701)─┬─containerd-shim(702)─┬─bash(703)
│ │ │ └─3*[{containerd-shim}(704,705,706)]
│ │ └─6*[{containerd}(707,708,709,710,711,712)]
│ └─7*[{dockerd}(689,690,691,692,693,694,695)]
├─gdm3(575)─┬─Xorg(586)
│ └─gnome-session-b(587)─┬─gnome-shell(588)
│ ├─ibus-daemon(589)─┬─ibus-engine-sim(592)
│ │ └─2*[{ibus-daemon}(590,591)]
│ └─2*[{gnome-session-b}(595,596)]
├─irqbalance(543)
├─kerneloops(546)
├─kube-proxy(697)
├─kubelet(696)
├─lightdm(576)─┬─Xorg(585)
│ └─lightdm(577)───sh(578)───fluxbox(579)
├─lxcfs(542)
├─lxd(698)─┬─lxd(699)
│ └─2*[{lxd}(700,701)]
├─polkitd(534)───2*[{polkitd}(535,536)]
├─rsyslogd(541)
├─snapd(694)───10*[{snapd}(695,696,697,698,699,700,701,702,703,704)]
├─ssh-agent(587)
├─systemd-journal(526)
├─systemd-logind(529)
├─systemd-networkd(527)
├─systemd-resolve(528)
├─systemd-timesyn(540)
├─systemd-udevd(525)
├─udisksd(537)───3*[{udisksd}(538,539,540)]
├─unattended-upgr(547)───2*[{unattended-upgr}(548,549)]
├─upowerd(535)───2*[{upowerd}(536,537)]
├─user-manager(586)───3*[{user-manager}(587,588,589)]
└─whoopsie(550)───2*[{whoopsie}(551,552)]This output now includes the process ID alongside each process name.
To see which user is running each process, use the -u option:
$ pstree -u
systemd─┬─ModemManager─┬─dhclient
│ └─2*[{ModemManager}]
├─NetworkManager─┬─dhclient
│ └─2*[{NetworkManager}]
├─accounts-daemon───2*[{accounts-daemon}]
├─apache2─┬─apache2
│ └─2*[apache2]
├─atd
├─cron
├─dbus-daemon
├─dockerd─┬─containerd─┬─containerd-shim─┬─bash
│ │ │ └─3*[{containerd-shim}]
│ │ └─6*[{containerd}]
│ └─7*[{dockerd}]
├─gdm3─┬─Xorg
│ └─gnome-session-b─┬─gnome-shell
│ ├─ibus-daemon─┬─ibus-engine-sim
│ │ └─2*[{ibus-daemon}]
│ └─2*[{gnome-session-b}]
├─irqbalance
├─kerneloops
├─kube-proxy
├─kubelet
├─lightdm─┬─Xorg
│ └─lightdm───sh───fluxbox
├─lxcfs
├─lxd─┬─lxd
│ └─2*[{lxd}]
├─polkitd───2*[{polkitd}]
├─rsyslogd
├─snapd───10*[{snapd}]
├─ssh-agent
├─systemd-journal
├─systemd-logind
├─systemd-networkd
├─systemd-resolve
├─systemd-timesyn
├─systemd-udevd
├─udisksd───3*[{udisksd}]
├─unattended-upgr───2*[{unattended-upgr}]
├─upowerd───2*[{upowerd}]
├─user-manager───3*[{user-manager}]
└─whoopsie───2*[{whoopsie}]This command enhances the output by showing the user associated with each process.
pstree is a core tool for Linux systemadmins. The following section will explore more advanced ways to leverage pstree for deeper system insights.
Exploring Process Hierarchy with pstree
This section explores advanced techniques for analyzing process hierarchies using the pstree command and its customization options.
To display the process hierarchy in a more condensed format, use the -c option:
$ pstree -c
systemd─┬─ModemManager─┬─dhclient
│ └─2*[{ModemManager}]
├─NetworkManager─┬─dhclient
│ └─2*[{NetworkManager}]
├─accounts-daemon───2*[{accounts-daemon}]
├─apache2─┬─apache2
│ └─2*[apache2]
├─atd
├─cron
├─dbus-daemon
├─dockerd─┬─containerd─┬─containerd-shim─┬─bash
│ │ │ └─3*[{containerd-shim}]
│ │ └─6*[{containerd}]
│ └─7*[{dockerd}]
├─gdm3─┬─Xorg
│ └─gnome-session-b─┬─gnome-shell
│ ├─ibus-daemon─┬─ibus-engine-sim
│ │ └─2*[{ibus-daemon}]
│ └─2*[{gnome-session-b}]
├─irqbalance
├─kerneloops
├─kube-proxy
├─kubelet
├─lightdm─┬─Xorg
│ └─lightdm───sh───fluxbox
├─lxcfs
├─lxd─┬─lxd
│ └─2*[{lxd}]
├─polkitd───2*[{polkitd}]
├─rsyslogd
├─snapd───10*[{snapd}]
├─ssh-agent
├─systemd-journal
├─systemd-logind
├─systemd-networkd
├─systemd-resolve
├─systemd-timesyn
├─systemd-udevd
├─udisksd───3*[{udisksd}]
├─unattended-upgr───2*[{unattended-upgr}]
├─upowerd───2*[{upowerd}]
├─user-manager───3*[{user-manager}]
└─whoopsie───2*[{whoopsie}]The -c option simplifies the output, making it more readable for complex process structures.
To filter the output and focus on specific processes, like those related to docker, combine pstree with grep. The -a option ensures full command lines are displayed:
$ pstree -a | grep docker
dockerd─┬─containerd─┬─containerd-shim─┬─bash
│ │ └─3*[containerd-shim]
│ └─6*[containerd]
└─7*[dockerd]This displays all processes directly or indirectly related to Docker.
To display PIDs when filtering, use the -p option in conjunction with grep:
$ pstree -p | grep docker
dockerd(688)─┬─containerd(701)─┬─containerd-shim(702)─┬─bash(703)
│ │ └─3*[containerd-shim(704,705,706)]
│ └─6*[containerd(707,708,709,710,711,712)]
└─7*[dockerd(689,690,691,692,693,694,695)]This is useful for pinpointing specific processes using their unique IDs.
You can also view the process hierarchy for a specific user, such as 'labex', using the -u option:
$ pstree -u labex
systemd─┬─ModemManager─┬─dhclient
│ └─2*[{ModemManager}]
├─NetworkManager─┬─dhclient
│ └─2*[{NetworkManager}]
├─accounts-daemon───2*[{accounts-daemon}]
├─apache2─┬─apache2
│ └─2*[apache2]
├─atd
├─cron
├─dbus-daemon
├─dockerd─┬─containerd─┬─containerd-shim─┬─bash
│ │ │ └─3*[{containerd-shim}]
│ │ └─6*[{containerd}]
│ └─7*[{dockerd}]
├─gdm3─┬─Xorg
│ └─gnome-session-b─┬─gnome-shell
│ ├─ibus-daemon─┬─ibus-engine-sim
│ │ └─2*[{ibus-daemon}]
│ └─2*[{gnome-session-b}]
├─irqbalance
├─kerneloops
├─kube-proxy
├─kubelet
├─lightdm─┬─Xorg
│ └─lightdm───sh───fluxbox
├─lxcfs
├─lxd─┬─lxd
│ └─2*[{lxd}]
├─polkitd───2*[{polkitd}]
├─rsyslogd
├─snapd───10*[{snapd}]
├─ssh-agent
├─systemd-journal
├─systemd-logind
├─systemd-networkd
├─systemd-resolve
├─systemd-timesyn
├─systemd-udevd
├─udisksd───3*[{udisksd}]
├─unattended-upgr───2*[{unattended-upgr}]
├─upowerd───2*[{upowerd}]
├─user-manager───3*[{user-manager}]
└─whoopsie───2*[{whoopsie}]This will show the processes owned by the specified user, aiding in user-specific troubleshooting.
The pstree command, combined with these options, is a powerful tool for system admins to understand the processes running on a Linux system.
Filtering and Customizing pstree Output
In this section, we'll explore more advanced techniques to filter and customize the pstree command output, allowing you to tailor it to your specific requirements as a systemadmin.
To focus on a specific process and its descendants, use the -s option. For instance, to view the systemd process tree:
$ pstree -s systemd
systemdThis highlights the path to the systemd process.
The -g option groups processes by their process group ID (PGID), offering an alternative perspective on process relationships:
$ pstree -g
1-systemd
├─577-ModemManager
│ ├─593-dhclient
│ └─2*[580-{ModemManager},581-{ModemManager}]
├─572-NetworkManager
│ ├─590-dhclient
│ └─2*[573-{NetworkManager},574-{NetworkManager}]
├─531-accounts-daemon
│ ├─532-{accounts-daemon}
│ └─533-{accounts-daemon}
├─688-apache2
│ ├─689-apache2
│ └─2*[690-apache2,691-apache2]
├─544-atd
├─545-cron
├─530-dbus-daemon
├─688-dockerd
│ ├─701-containerd
│ │ ├─702-containerd-shim
│ │ │ └─703-bash
│ │ └─6*[707-{containerd},708-{containerd},709-{containerd},710-{containerd},711-{containerd},712-{containerd}]
│ └─7*[689-{dockerd},690-{dockerd},691-{dockerd},692-{dockerd},693-{dockerd},694-{dockerd},695-{dockerd}]
├─575-gdm3
│ ├─586-Xorg
│ └─587-gnome-session-b
│ ├─588-gnome-shell
│ ├─589-ibus-daemon
│ │ ├─592-ibus-engine-sim
│ │ └─2*[590-{ibus-daemon},591-{ibus-daemon}]
│ └─2*[595-{gnome-session-b},596-{gnome-session-b}]
├─543-irqbalance
├─546-kerneloops
├─697-kube-proxy
├─696-kubelet
├─576-lightdm
│ ├─585-Xorg
│ └─577-lightdm
│ ├─578-sh
│ └─579-fluxbox
├─542-lxcfs
├─698-lxd
│ ├─699-lxd
│ └─2*[700-{lxd},701-{lxd}]
├─534-polkitd
│ ├─535-{polkitd}
│ └─536-{polkitd}
├─541-rsyslogd
├─694-snapd
│ └─10*[695-{snapd},696-{snapd},697-{snapd},698-{snapd},699-{snapd},700-{snapd},701-{snapd},702-{snapd},703-{snapd},704-{snapd}]
├─587-ssh-agent
├─526-systemd-journal
├─529-systemd-logind
├─527-systemd-networkd
├─528-systemd-resolve
├─540-systemd-timesyn
├─525-systemd-udevd
├─537-udisksd
│ ├─538-{udisksd}
│ ├─539-{udisksd}
│ └─540-{udisksd}
├─547-unattended-upgr
│ ├─548-{unattended-upgr}
│ └─549-{unattended-upgr}
├─535-upowerd
│ ├─536-{upowerd}
│ └─537-{upowerd}
├─586-user-manager
│ ├─587-{user-manager}
│ ├─588-{user-manager}
│ └─589-{user-manager}
└─550-whoopsie
├─551-{whoopsie}
└─552-{whoopsie}This is useful for identifying related processes that might not be directly in the same process tree.
Highlight the current process in the output using the -H option. The $$ variable represents the current shell's PID:
$ pstree -H $$
systemd─┬─ModemManager─┬─dhclient
│ └─2*[{ModemManager}]
├─NetworkManager─┬─dhclient
│ └─2*[{NetworkManager}]
├─accounts-daemon───2*[{accounts-daemon}]
├─apache2─┬─apache2
│ └─2*[apache2]
├─atd
├─cron
├─dbus-daemon
├─dockerd─┬─containerd─┬─containerd-shim─┬─bash
│ │ │ └─3*[{containerd-shim}]
│ │ └─6*[{containerd}]
│ └─7*[{dockerd}]
├─gdm3─┬─Xorg
│ └─gnome-session-b─┬─gnome-shell
│ ├─ibus-daemon─┬─ibus-engine-sim
│ │ └─2*[{ibus-daemon}]
│ └─2*[{gnome-session-b}]
├─irqbalance
├─kerneloops
├─kube-proxy
├─kubelet
├─lightdm─┬─Xorg
│ └─lightdm───sh───fluxbox
├─lxcfs
├─lxd─┬─lxd
│ └─2*[{lxd}]
├─polkitd───2*[{polkitd}]
├─rsyslogd
├─snapd───10*[{snapd}]
├─ssh-agent
├─systemd-journal
├─systemd-logind
├─systemd-networkd
├─systemd-resolve
├─systemd-timesyn
├─systemd-udevd
├─udisksd───3*[{udisksd}]
├─unattended-upgr───2*[{unattended-upgr}]
├─upowerd───2*[{upowerd}]
├─user-manager───3*[{user-manager}]
└─whoopsie───2*[{whoopsie}]This helps you quickly locate your current shell session within the process tree.
Mastering these pstree options enables systemadmins to effectively monitor, manage, and troubleshoot Linux systems.
Summary
This tutorial introduced the pstree command, an essential tool for understanding process hierarchies in Linux. We covered its fundamental usage, options for filtering and customizing output, and its application in system administration. By understanding process relationships, systemadmins can diagnose issues more efficiently and maintain system stability.
We explored how to execute the pstree command, interpret the resulting tree-like structure, and utilize options to filter and focus on specific processes or process groups. You now possess the skills to use pstree effectively to analyze and manage processes on Linux systems.