2

How can I view all the ancestors for all instances of a given process name?

2

The pstree program seems to be quite nice for this e.g.

$ pidof bash | xargs -n 1 pstree -sp
init(1)───lightdm(1284)───lightdm(1577)───init(2017)───gnome-terminal(2595)───bash(18001)───man(10946)───pager(10955)
init(1)───lightdm(1284)───lightdm(1577)───init(2017)───gnome-terminal(2595)───bash(12895)
init(1)───sshd(1181)───sshd(11860)───sshd(11938)───bash(11939)───xargs(12124)───pstree(12127)
init(1)───sshd(1181)───sshd(9235)───sshd(9316)───bash(9317)
init(1)───lightdm(1284)───lightdm(1577)───init(2017)───gnome-terminal(2595)───bash(2897)
  • My version of pstree (22.6) doesn't support -s; not sure what it's supposed to do. – Wildcard Dec 11 '15 at 3:35
  • 1
    @Wildcard -s is the flag to show parent processes - so if your version doesn't have it, the approach won't work for you – steeldriver Dec 11 '15 at 3:44
0

I worked out the following one-liner to accomplish this; there may be a better way. The regex /[b]ash/ is what selects the process name to match.

ps -ef | awk ' NR == 1 { header = $0; next } { pid[$2] = $0 } /[b]ash/ { toprint[$2] } END { print header; for (i in toprint) { while (i != 1) { split(pid[i], pieces, " "); i = pieces[3]; toprint[i] } } for (i in toprint) { print pid[i] } }'

I actually worked this out first as a full script and then condensed it to a one-liner; here is the more readable version:

ps -ef | awk '
NR == 1 {
  header = $0
  next
}
{
  pid[$2] = $0                    # Save all lines of ps -ef in this array, stored by PID
}
/[b]ash/ {                        # Modify this regex to change the filter
  toprint[$2]                     # Designate all these PIDs as "to print"
}
END {
  print header
  for (i in toprint) {            # For each PID designated "to be printed":
    while (i != 1) {
      split(pid[i], pieces, " ")  # Look up the info on that process
      i = pieces[3]               # Set i to the PPID
      toprint[i]                  # Designate that PPID as "to print"
    }                             # Recurse to get the parent of that process, until PID 1 is reached.
  }
  for (i in toprint) {            # Then actually print the data.
    print pid[i]
  }
}'

Example output:

UID        PID  PPID  C STIME TTY          TIME CMD
root     23181 23137  0 15:33 pts/2    00:00:00 sudo su
vagrant  23136 23133  0 15:33 ?        00:00:01 sshd: vagrant@pts/2
root     23182 23181  0 15:33 pts/2    00:00:00 su
vagrant  23137 23136  0 15:33 pts/2    00:00:00 -bash
root      1041     1  0 Jan16 ?        00:00:00 /usr/sbin/sshd
root     23183 23182  0 15:33 pts/2    00:00:00 bash
root     12980     1  0 10:58 ?        00:00:01 /bin/bash /var/cfengine/bin/runalerts.sh
root         1     0  0 Jan16 ?        00:00:01 /sbin/init
root     23133  1041  0 15:33 ?        00:00:00 sshd: vagrant [priv]

Note the parent PIDs listed in the above list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.