When working on a Linux system, sometimes you need to figure out what processes are running and which PID or PPID is tied to it. It can be used for several purposes.
Basically, we search for a PID in Linux to kill an unresponsive program, which can be done by the GUI task manager, but CLI is the most efficient way to handle unresponsive programs.
This is better than the GUI, because sometimes GUI-based tools may not show the still running hidden process.
In this tutorial, we will show you how to find the process ID (PID) of a program running in many ways in Linux.
What is process ID (PID)?
PID refers to process ID, which is commonly used by most operating system kernels, such as Linux, Unix, MacOS and Windows.
This is a unique ID that is automatically assigned to each process when it is created. A process is a running instance of a program.
What is parent process ID (PPID)?
A parent process is a process that has created one or more child processes. Each child process is given a Parental Process ID (PPID), and the parent process kills the child when it completes their operation.
You may be interested to read the below articles, as these are related to this topic.
- How to Find Out Which Port Number a Process is Using in Linux
- 3 Easy Ways to Kill or Terminate a Process in Linux
Each time the process ID is changed for all processes except init. The init process is always the first process in the system and the ancestor of all other processes, it holds PID 1.
The default maximum value of PIDs is 32768 on 32-bit machine. And you can set the value higher on 64-bit systems up to 2^22 (approximately 4 million). This can be verified by running the following command on your machine:
cat /proc/sys/kernel/pid_max
You may ask, why do we need such large number of PIDs? This is because PIDs cannot be reused immediately and also to prevent potential errors.
You can find the PID of processes running on the system using the below nine command.
pidof:pidof – find the process ID of a running program.pgrep:pgre – look up or signal processes based on name and other attributes.ps:ps – report a snapshot of the current processes.pstree:pstree – display a tree of processes.ss:ss is used to dump socket statistics.netstat:netstat is displays a list of open sockets.lsof:lsof – list open files.fuser:fuser – list process IDs of all processes that have one or more files opensystemctl:systemctl – Control the systemd system and service manager
To prove this, we are going to find the Apache process ID. Make sure to enter your process name instead of ours.
1) Finding a process ID (PID) with pidof command
The pidof command is used to find the process ID of the running program. It prints those IDs into the standard output. To demonstrate this, we will be finding the ‘Apache2’ process id in the system.
# pidof apache2
3754 2594 2365 2364 2363 2362 2361
In the above output you may have difficulties identifying the process ID because it displays all PIDs (including parent and child) against the process name.
So we need to find the Parent Process PID (PPID), which is what we are looking for. This will be the first number. In my case it is 3754 and it is sorted in descending order.
2) How to search a process ID (PID) in Linux, using pgrep command?
The pgrep command looks at the processes currently running, and lists the process IDs that match the selection criteria.
# pgrep apache2
2361
2362
2363
2364
2365
2594
3754
The above output is similar to the ‘pidof’ command output, but it sorted the results in ascending order, which clearly shows that the parent process PID is standing at last.In my case it is 3754.
Note: Identifying the parent process ID can be problematic when using the ‘pidof’ & ‘pgrep’ command, as each process comes with a single PPID and multiple PIDs which doesn’t show a clear demarcation between them. Hence please exercise caution while looking at the results.
3) locating a process ID (PID) with pstree
The pstree command shows running processes as a tree-like format which is very convenient way to display the process hierarchy and makes the output more visually appealing. If a user name is specified in the pstree command then it shows all the processes owned by the respective user.
pstree visually merges identical branches by putting them in square brackets and prefixing them with the repetition count.
# pstree -p | grep "apache2"
|-apache2(3754)-+-apache2(2361)
| |-apache2(2362)
| |-apache2(2363)
| |-apache2(2364)
| |-apache2(2365)
| `-apache2(2594)
To get only the parent process, use the following format.
# pstree -p | grep "apache2" | head -1
|-apache2(3754)-+-apache2(2361)
‘pstree’ command is much better than the ‘pidof’ & ‘pgrep’ commands, because it separates parent from the child processes which is not possible by them.
4) How to find a process ID (PID) using ps command?
The ps command displays information about a selection of the active processes which includes the process ID (pid=PID), terminal associated with the process (tname=TTY), cumulated CPU time in [DD-]hh:mm:ss format (time=TIME), and executable name (ucmd=CMD). Output is unsorted by default.
# ps aux | grep "apache2"
www-data 2361 0.0 0.4 302652 9732 ? S 06:25 0:00 /usr/sbin/apache2 -k start
www-data 2362 0.0 0.4 302652 9732 ? S 06:25 0:00 /usr/sbin/apache2 -k start
www-data 2363 0.0 0.4 302652 9732 ? S 06:25 0:00 /usr/sbin/apache2 -k start
www-data 2364 0.0 0.4 302652 9732 ? S 06:25 0:00 /usr/sbin/apache2 -k start
www-data 2365 0.0 0.4 302652 8400 ? S 06:25 0:00 /usr/sbin/apache2 -k start
www-data 2594 0.0 0.4 302652 8400 ? S 06:55 0:00 /usr/sbin/apache2 -k start
root 3754 0.0 1.4 302580 29324 ? Ss Dec11 0:23 /usr/sbin/apache2 -k start
root 5648 0.0 0.0 12784 940 pts/0 S+ 21:32 0:00 grep apache2
The Parent Process ID (PPID) can be easily identified based on the process start date from the above output. In our case the ‘Apache2’ process started on December 11th, which is the parent process and the others are the child processes. The PID of Apache2 is 3754.
5) Finding a process ID (PID) using ss command
The ss command is used to dump socket statistics. It allows showing information similar to netstat. It can display more TCP and state information than other tools.
It can display stats for all kind of sockets such as PACKET, TCP, UDP, DCCP, RAW, Unix domain, etc.
# ss -tnlp | grep apache2
LISTEN 0 128 :::80 :::* users:(("apache2",pid=3319,fd=4),("apache2",pid=3318,fd=4),("apache2",pid=3317,fd=4))
6) Finding a process ID (PID) with netstat command
The netstat command is used to print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. By default, netstat displays a list of open sockets.
If you don’t specify any address families, then the active sockets of all configured address families will be printed. This program is obsolete. Replacement for netstat is ss.
# netstat -tnlp | grep apache2
tcp6 0 0 :::80 :::* LISTEN 3317/apache2
7) How to find a process ID (PID) in Linux, using lsof command?
The lsof command is used to list open files. The Linux lsof command lists information about files that are open by processes running on the system.
# lsof -i -P | grep apache2
apache2 3317 root 4u IPv6 40518 0t0 TCP *:80 (LISTEN)
apache2 3318 www-data 4u IPv6 40518 0t0 TCP *:80 (LISTEN)
apache2 3319 www-data 4u IPv6 40518 0t0 TCP *:80 (LISTEN)
8) Searching a process ID (PID) using fuser command
The fuser utility shall write to standard output, the process IDs of processes running on the local system that have one or more named files open.
# fuser -v 80/tcp
USER PID ACCESS COMMAND
80/tcp: root 3317 F.... apache2
www-data 3318 F.... apache2
www-data 3319 F.... apache2
9) How to find a process ID (PID) in Linux, using systemctl command?
The systemctl command is used to control the systemd service manager. This is a replacement for the old SysVinit system management, and most of the modern Linux operating systems have been moved to the systemd.
# systemctl status apache2
● apache2.service - The Apache HTTP Server
Loaded: loaded (/lib/systemd/system/apache2.service; disabled; vendor preset: enabled)
Drop-In: /lib/systemd/system/apache2.service.d
└─apache2-systemd.conf
Active: active (running) since Tue 2018-09-25 10:03:28 IST; 3s ago
Process: 3294 ExecStart=/usr/sbin/apachectl start (code=exited, status=0/SUCCESS)
Main PID: 3317 (apache2)
Tasks: 55 (limit: 4915)
Memory: 7.9M
CPU: 71ms
CGroup: /system.slice/apache2.service
├─3317 /usr/sbin/apache2 -k start
├─3318 /usr/sbin/apache2 -k start
└─3319 /usr/sbin/apache2 -k start
Sep 25 10:03:28 ubuntu systemd[1]: Starting The Apache HTTP Server...
Sep 25 10:03:28 ubuntu systemd[1]: Started The Apache HTTP Server.
Conclusion
We have shown you several command to find out the PIDs of a specific running program in Linux.
If you have questions, feel free to leave a comment below.
References:
