Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Slackware 13.37, and I was wondering if there was a way to tell which script executed a command. I tracked the process and its arguments, but I would like to know where the command originated from.

share|improve this question
In what type of scenario: is the command running at the time of your investigation? Do you want to investigate all executions of the command or just some? Can you set up a monitoring method beforehand or is this strictly forensic? Can you control all the ways the command is run? Can you modify the command's executable? Browsing process+monitoring might provide inspiration. – Gilles May 27 '11 at 10:08

There is no guaranteed generic way to do that apart from walking the process tree (by looking at the commands PPID, then that process's PPID, etc...).

There's a good utility for that though, if you're not trying to script something: pstree. It will give you a "graphical" view of the process hierarchy. Something like:

$ pstree -a
  ├─udevd --daemon
  │   ├─udevd --daemon
  │   └─udevd --daemon
  │   └─bash
  │       └─pstree -ah
      ├─X :0 vt7 -auth /var/lib/xdm/authdir/authfiles/A:0-g8w3zk
              │   ├─chrome
              │   └─21*[{chrome}]

There are options to show the PIDs, show or hide the command lines, etc...

share|improve this answer
You can also use ps -axf. The f is for forrest, but it looks like a tree. ;-) – Keith May 27 '11 at 5:25
Thanks so much! – zero cola May 27 '11 at 6:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.