This script

$ cat csub.sh 

while true;
  sleep 5
  AVAR=$(date; sleep 2)

when started, makes a process appear in the ps output:

ps -eLf|egrep '[c]sub.sh|PID'
jimmy    31364 23445 31364  0    1 00:33 pts/7    00:00:00 /bin/bash ./csub.sh

which is quite predictable as well as the fact that $(date; sleep 2) spawns another process

Surprising is that the spawned process has identical CMD displayed

jimmy    31364 23445 31364  0    1 00:33 pts/7    00:00:00 /bin/bash ./csub.sh
jimmy    31433 31364 31433  0    1 00:33 pts/7    00:00:00 /bin/bash ./csub.sh

I added sleep to be able to catch the process into the ps output, otherwise one have much less chances to, because it's too short. As you see the spawned process 31433 has 31364 as its parent. I would expect the spawned process has some different CMD mentioning what it deals with, e.g date or sleep command. For cases when there are multiple command substitutions, how could I distinguish them when I see a spawned process appeared?

1 Answer 1


From the manual page, section 2 for fork():

fork() creates a new process by duplicating the calling process. The new process, referred to as the child, is an exact duplicate of the calling process, referred to as the parent, except for the following points:

  • The child has its own unique process ID, and this PID does not match the ID of any existing process group (setpgid(2)).
  • The child's parent process ID is the same as the parent's process ID.
  • The child does not inherit its parent's memory locks (mlock(2), mlockall(2)).
  • Process resource utilizations (getrusage(2)) and CPU time counters (times(2)) are reset to zero in the child.
  • The child's set of pending signals is initially empty (sigpending(2)).
  • The child does not inherit semaphore adjustments from its parent (semop(2)).
  • The child does not inherit record locks from its parent (fcntl(2)).
  • The child does not inherit timers from its parent (setitimer(2), alarm(2), timer_create(2)).
  • The child does not inherit outstanding asynchronous I/O operations from its parent (aio_read(3), aio_write(3)), nor does it inherit any asynchronous I/O contexts from its parent (see io_setup(2)).

Not on this list is the invocation command line of the process, so that will be identical to its parent. You can tell children apart from their parents because the child's PPID (Parent PID) will be the originating process's PID.

  • Thanks for the good reference, Does Parent-Child relation mean there's always a fork behind it? That would mean children always have parent's name (CMD in ps notation), which is apparently false. otherwise all the linux processes would be named init. Is there something bash-specific in my case? Could you explain that please?
    – Tagwint
    May 7, 2016 at 23:27
  • Only new processes spawned by fork() inherit the name of their parents. All processes do have a parent, which will become init if the parent dies without reaping its child.
    – DopeGhoti
    May 8, 2016 at 0:54
  • I am afraid I am still missing the gist. When I see ps -ef output I can see children of same parent having different names. Here's my sample hastebin.com/enawowoweh.hs Following your last comment, how can i interpret that? Are they a) not new | b) not spawned | c) spawned not by fork ?
    – Tagwint
    May 8, 2016 at 1:32
  • 1
    Yes, that's the point i missed - spawning is not necessarily forking. Finally got it. Thank you for making me get it.
    – Tagwint
    May 8, 2016 at 1:49
  • 1
    @Tagwint The command listed by ps changes when the process calls the execve system call to load a new program image into the existing process. When the shell launches an external program, it first calls fork to create a new process (which doesn't change the command line) and then execve (which loads code from an executable file, and at the same time changes the command line). May 8, 2016 at 19:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .