2 added 741 characters in body
source | link

I worked out the following one-liner to accomplish this; there may be a better way. The regex /bash[b]ash/ is what selects the process name to match.

ps -ef | awk ' NR == 1 { header = $0; next } { pid[$2] = $0 } /bash[b]ash/ { toprint[$2] } END { print header; for (i in toprint) { while (i != 1) { split(pid[i], pieces, " "); i = pieces[3]; toprint[i] } } for (i in toprint) { print pid[i] } }'
ps -ef | awk '
NR == 1 {
  header = $0
  next
}
{
  pid[$2] = $0                    # Save all lines of ps -ef in this array, stored by PID
}
/bash[b]ash/ {                          # Modify this regex to change the filter
  toprint[$2]                     # Designate all these PIDs as "to print"
}
END {
  print header
  for (i in toprint) {            # For each PID designated "to be printed":
    while (i != 1) {
      split(pid[i], pieces, " ")  # Look up the info on that process
      i = pieces[3]               # Set i to the PPID
      toprint[i]                  # Designate that PPID as "to print"
    }                             # Recurse to get the parent of that process, until PID 1 is reached.
  }
  for (i in toprint) {            # Then actually print the data.
    print pid[i]
  }
}'

Example output:

UID        PID  PPID  C STIME TTY          TIME CMD
root     23181 23137  0 15:33 pts/2    00:00:00 sudo su
vagrant  23136 23133  0 15:33 ?        00:00:01 sshd: vagrant@pts/2
root     23182 23181  0 15:33 pts/2    00:00:00 su
vagrant  23137 23136  0 15:33 pts/2    00:00:00 -bash
root      1041     1  0 Jan16 ?        00:00:00 /usr/sbin/sshd
root     23183 23182  0 15:33 pts/2    00:00:00 bash
root     12980     1  0 10:58 ?        00:00:01 /bin/bash /var/cfengine/bin/runalerts.sh
root         1     0  0 Jan16 ?        00:00:01 /sbin/init
root     23133  1041  0 15:33 ?        00:00:00 sshd: vagrant [priv]

Note the parent PIDs listed in the above list.

I worked out the following one-liner to accomplish this; there may be a better way. The regex /bash/ is what selects the process name to match.

ps -ef | awk ' NR == 1 { header = $0; next } { pid[$2] = $0 } /bash/ { toprint[$2] } END { print header; for (i in toprint) { while (i != 1) { split(pid[i], pieces, " "); i = pieces[3]; toprint[i] } } for (i in toprint) { print pid[i] } }'
ps -ef | awk '
NR == 1 {
  header = $0
  next
}
{
  pid[$2] = $0                    # Save all lines of ps -ef in this array, stored by PID
}
/bash/ {                          # Modify this regex to change the filter
  toprint[$2]                     # Designate all these PIDs as "to print"
}
END {
  print header
  for (i in toprint) {            # For each PID designated "to be printed":
    while (i != 1) {
      split(pid[i], pieces, " ")  # Look up the info on that process
      i = pieces[3]               # Set i to the PPID
      toprint[i]                  # Designate that PPID as "to print"
    }                             # Recurse to get the parent of that process, until PID 1 is reached.
  }
  for (i in toprint) {            # Then actually print the data.
    print pid[i]
  }
}'

I worked out the following one-liner to accomplish this; there may be a better way. The regex /[b]ash/ is what selects the process name to match.

ps -ef | awk ' NR == 1 { header = $0; next } { pid[$2] = $0 } /[b]ash/ { toprint[$2] } END { print header; for (i in toprint) { while (i != 1) { split(pid[i], pieces, " "); i = pieces[3]; toprint[i] } } for (i in toprint) { print pid[i] } }'
ps -ef | awk '
NR == 1 {
  header = $0
  next
}
{
  pid[$2] = $0                    # Save all lines of ps -ef in this array, stored by PID
}
/[b]ash/ {                        # Modify this regex to change the filter
  toprint[$2]                     # Designate all these PIDs as "to print"
}
END {
  print header
  for (i in toprint) {            # For each PID designated "to be printed":
    while (i != 1) {
      split(pid[i], pieces, " ")  # Look up the info on that process
      i = pieces[3]               # Set i to the PPID
      toprint[i]                  # Designate that PPID as "to print"
    }                             # Recurse to get the parent of that process, until PID 1 is reached.
  }
  for (i in toprint) {            # Then actually print the data.
    print pid[i]
  }
}'

Example output:

UID        PID  PPID  C STIME TTY          TIME CMD
root     23181 23137  0 15:33 pts/2    00:00:00 sudo su
vagrant  23136 23133  0 15:33 ?        00:00:01 sshd: vagrant@pts/2
root     23182 23181  0 15:33 pts/2    00:00:00 su
vagrant  23137 23136  0 15:33 pts/2    00:00:00 -bash
root      1041     1  0 Jan16 ?        00:00:00 /usr/sbin/sshd
root     23183 23182  0 15:33 pts/2    00:00:00 bash
root     12980     1  0 10:58 ?        00:00:01 /bin/bash /var/cfengine/bin/runalerts.sh
root         1     0  0 Jan16 ?        00:00:01 /sbin/init
root     23133  1041  0 15:33 ?        00:00:00 sshd: vagrant [priv]

Note the parent PIDs listed in the above list.

1
source | link

I worked out the following one-liner to accomplish this; there may be a better way. The regex /bash/ is what selects the process name to match.

ps -ef | awk ' NR == 1 { header = $0; next } { pid[$2] = $0 } /bash/ { toprint[$2] } END { print header; for (i in toprint) { while (i != 1) { split(pid[i], pieces, " "); i = pieces[3]; toprint[i] } } for (i in toprint) { print pid[i] } }'

I actually worked this out first as a full script and then condensed it to a one-liner; here is the more readable version:

ps -ef | awk '
NR == 1 {
  header = $0
  next
}
{
  pid[$2] = $0                    # Save all lines of ps -ef in this array, stored by PID
}
/bash/ {                          # Modify this regex to change the filter
  toprint[$2]                     # Designate all these PIDs as "to print"
}
END {
  print header
  for (i in toprint) {            # For each PID designated "to be printed":
    while (i != 1) {
      split(pid[i], pieces, " ")  # Look up the info on that process
      i = pieces[3]               # Set i to the PPID
      toprint[i]                  # Designate that PPID as "to print"
    }                             # Recurse to get the parent of that process, until PID 1 is reached.
  }
  for (i in toprint) {            # Then actually print the data.
    print pid[i]
  }
}'