pstree

What it does

How to write it

pstree [OPTION]... [PID | USER]

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1The whole tree

   $pstree | head
   systemd─┬─NetworkManager───3*[{NetworkManager}]
           ├─chronyd
           ├─sshd───sshd───sshd───bash───pstree

   {…} are threads.

2. 2With PIDs

   $pstree -p | head

   Find the PID of a parent quickly.

3. 3Tree of one process

   $pstree -p 1010

   Only the sshd master and its sessions.

4. 4Where does my shell come from?

   $pstree -s -p $$
   systemd(1)───sshd(1010)───sshd(2210)───sshd(2215)───bash(2216)

   The chain of parents.

5. 5Show the user of each part

   $pstree -u

   (apache) shows where a process changed to another user.

6. 6Full command lines

   $pstree -a | less

   Shows the options of each program.

7. 7Processes of one user

   $pstree lisa

   All trees owned by lisa.

8. 8Find odd children of a web server (security)

   $pstree -p -a $(pgrep -o httpd)

   A shell (bash, sh) under httpd can mean a web shell attack.

9. 9Do not compact

   $pstree -c -p | grep httpd

   Every child on its own line.

10. 10Container namespaces

    #pstree -N pid

    Separate trees for each PID namespace (containers).

Nothing matches this filter.

Exit codes