How to view the process tree in Linux
Inspecting the process tree in Linux clarifies how system services, login sessions, and background jobs relate to one another, which simplifies tracking down runaway processes and understanding what spawned a given task.
The kernel records a parent process ID for each child and exposes this relationship through /proc, which tools such as ps and pstree read to reconstruct a hierarchical view. Using a tree layout makes it easier to see which terminal, service, or supervisor launched each process, especially in complex environments with many daemons and shells.
Visibility of other users’ processes can depend on system security settings and privileges, and some distributions package pstree inside the psmisc package rather than as a dedicated binary, so package names and availability differ across environments.
Steps to display process tree in Linux:
- Open a terminal in Linux.
- Use the ps command to display running processes in a simple list.
$ ps -x PID TTY STAT TIME COMMAND 1 ? Ss 0:00 /lib/systemd/systemd 23 ? S<s 0:00 /usr/lib/systemd/systemd-journald 174 ? Ss 0:00 /usr/lib/systemd/systemd-logind 3846 ? Ss 0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups 4562 ? Rs 0:00 ps -x - Use the –forest option with the ps command to display processes in a tree structure.
$ ps -x --forest PID TTY STAT TIME COMMAND 4567 ? Rs 0:00 ps -x --forest 1 ? Ss 0:00 /lib/systemd/systemd 23 ? S<s 0:00 /usr/lib/systemd/systemd-journald 174 ? Ss 0:00 /usr/lib/systemd/systemd-logind 3846 ? Ss 0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startupsThe command ps aux --forest shows all processes with a tree view and extended details such as CPU and memory usage.
Manual: ps manual
- Install pstree from the distribution package repository if it is not available.
$ sudo apt update && sudo apt install --assume-yes psmisc
On CentOS, Red Hat, and Fedora, install psmisc with
$ sudo dnf install --assumeyes psmisc
.
- Use the pstree command to view the full process tree.
$ pstree systemd-+-dbus-daemon |-rsyslogd---3*[{rsyslogd}] |-sshd |-systemd-journal |-systemd-logind `-systemd-timesyn---{systemd-timesyn}The option pstree -p adds process IDs to each entry, which is useful when correlating with logs or tools like top and htop.
- Display additional pstree options when a different layout or sorting is needed.
More options for pstree:
Usage: pstree [-acglpsStTuZ] [ -h | -H PID ] [ -n | -N type ] [ -A | -G | -U ] [ PID | USER ] or: pstree -V Display a tree of processes. -a, --arguments show command line arguments -A, --ascii use ASCII line drawing characters -c, --compact-not don't compact identical subtrees -C, --color=TYPE color process by attribute (age) -h, --highlight-all highlight current process and its ancestors -H PID, --highlight-pid=PID highlight this process and its ancestors -g, --show-pgids show process group ids; implies -c -G, --vt100 use VT100 line drawing characters -l, --long don't truncate long lines -n, --numeric-sort sort output by PID -N TYPE, --ns-sort=TYPE sort output by this namespace type (cgroup, ipc, mnt, net, pid, time, user, uts) -p, --show-pids show PIDs; implies -c -s, --show-parents show parents of the selected process -S, --ns-changes show namespace transitions -t, --thread-names show full thread names -T, --hide-threads hide threads, show only processes -u, --uid-changes show uid transitions -U, --unicode use UTF-8 (Unicode) line drawing characters -V, --version display version information -Z, --security-context show security attributes PID start at this PID; default is 1 (init) USER show only trees rooted at processes of this user