Let's say we have a PID of a process and we know that it was started by init during startup. How do we find the script name that started it?

One way is to run grep $PROCESS_NAME /etc/init.d/*, but that solution is neither bulletproof nor very elegant.

Another one would be to run service --status-all and there is a good chance that the PID will be returned by one of the services, but that's even less elegant than the previous solution


The OS is RedHat/Ubuntu.

Let's suppose we have sshd running with PID 2083 like so:

root      2083     1  0  2012 ?        00:00:00 /usr/sbin/sshd -D

The parent of it is init and I guess that it was started with the command service sshd start during bootup, but if we have something that cannot be easily guessed, for example a convoluted startup command or because of an obfuscated /etc/init.d/somedeamon script - how do we find the somedeamon script, knowing only the PID?

  • 1
    This is OS dependent. What OS are you running? – jordanm Feb 6 '13 at 15:24
  • 1
    You seem to be mixing terms somewhere. If init runs the script that starts the process then the process (daemon) that started it would be init. If you're looking for a process that had started this one. You could look at PPID. If this is not what you're asking then please clarify what you mean. – Karlson Feb 6 '13 at 16:58
  • Sorry about the confussion. I've rewritten the question and I hope now it's clear. – user28403 Feb 6 '13 at 18:10

An easy way to follow the PPID chain backwards is with the pstree tool:

pstree -p PID

This will show all the parent processes of the specified PID, for example:

$ pstree 42284
-+= 00001 root /sbin/launchd
 \-+= 00199 jack /sbin/launchd
   \-+= 00254 jack /Applications/iTerm.app/Contents/MacOS/iTerm -psn_0_90134
     \-+= 00309 root login -fp jack
       \-+= 00310 jack -bash
         \--= 42284 jack vim site.txt
| improve this answer | |
  • 2
    Except when that doesn't work, which is not all that uncommon. Many daemons are started with a double fork (the script forks a launcher which forks the daemon thread then exits), so the PPID of the daemon is 1. – Gilles 'SO- stop being evil' Feb 6 '13 at 22:55

You should be able to follow the PPID chain backwards from the process you are interested in. But if, say, A launched B, B launched C, and B finished, now C's parent is init (PID 1). To access information about process PID, you do ps -l -pPID.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.