What Is a Process? ps, PIDs and Parents

Programs and processes

A program is a file on the disk, such as /usr/bin/ls. When you run it, Linux loads it into memory and starts a process: a running copy of the program, with its own memory and its own number, the process ID (PID).

Think of it like this: A program is a recipe in a cookbook; a process is someone cooking it right now. Ten cooks can follow the same recipe at once, and each one is a separate process with its own PID.

ps lists the processes running in your terminal:

ps

In the terminal

student@vulntech:~$ ps
  PID TTY          TIME CMD
 1294 ttyS0    00:00:03 bash
 1601 ttyS0    00:00:01 ps

There are two: bash, the shell that reads your commands, and ps itself, which was running while it made the list. TTY is the terminal the process belongs to and TIME how much CPU time it has used so far.

Every process has a parent

Processes are started by other processes. Your shell started ps, so the shell is its parent. ps -f (full) adds the owner (UID), the parent's PID (PPID) and the start time. $$ is the PID of the shell you're typing into:

echo $$
ps -f

In the terminal

student@vulntech:~$ echo $$
1294
student@vulntech:~$ ps -f
UID        PID  PPID  C STIME TTY          TIME CMD
student   1294  1292  0 14:37 ttyS0    00:00:03 -bash
student   1609  1294 99 14:56 ttyS0    00:00:01 ps -f

The PPID of ps is the PID of bash. Start a second shell inside the first one, and it becomes a child too:

bash
ps -f
exit
ps -f

In the terminal

student@vulntech:~$ bash
student@vulntech:~$ ps -f
UID        PID  PPID  C STIME TTY          TIME CMD
student   1294  1292  0 14:35 ttyS0    00:00:03 -bash
student   1601  1294 68 14:52 ttyS0    00:00:09 bash
student   1611  1601 99 14:53 ttyS0    00:00:00 ps -f
student@vulntech:~$ exit
exit
student@vulntech:~$ ps -f
UID        PID  PPID  C STIME TTY          TIME CMD
student   1294  1292  0 14:35 ttyS0    00:00:03 -bash
student   1628  1294 99 14:53 ttyS0    00:00:00 ps -f

exit ended the inner shell, and you were back in the first one.

The family tree: pstree

pstree draws every process on the machine as a tree. At the top is init, process number 1, which the kernel starts first and which starts everything else. -p adds the PIDs:

pstree
pstree -p $$

In the terminal

student@vulntech:~$ pstree
init─┬─login───bash───pstree
     └─vt-agent
student@vulntech:~$ pstree -p $$
bash(1294)───pstree(1610)

Find your bash and pstree near the bottom of the first tree. The second command only shows the branch that leads to your shell.

Remember: A process is a running program with a PID. ps lists yours, ps -f adds the parent (PPID), pstree shows the whole family.