How to view the process tree in Linux

Inspecting the process tree in Linux clarifies how system services, login sessions, and background jobs relate to one another, which simplifies tracking down runaway processes and understanding what spawned a given task.

The kernel records a parent process ID for each child and exposes this relationship through /proc, which tools such as ps and pstree read to reconstruct a hierarchical view. Using a tree layout makes it easier to see which terminal, service, or supervisor launched each process, especially in complex environments with many daemons and shells.

Visibility of other users’ processes can depend on system security settings and privileges, and some distributions package pstree inside the psmisc package rather than as a dedicated binary, so package names and availability differ across environments.

1. Open a terminal in Linux.
2. Use the ps command to display running processes in a simple list.

   $ ps -x
      PID TTY      STAT   TIME COMMAND
     1080 ?        Ss     0:00 /lib/systemd/systemd --user
     1081 ?        S      0:00 (sd-pam)
     1092 tty1     S+     0:00 -bash
     1175 ?        S      0:00 sshd: user@pts/0
     1176 pts/0    Ss     0:00 -bash
     1424 pts/0    R+     0:00 ps -x

3. Use the –forest option with the ps command to display processes in a tree structure.

   $ ps -x --forest
      PID TTY      STAT   TIME COMMAND
     1175 ?        S      0:00 sshd: user@pts/0
     1176 pts/0    Ss     0:00  \_ -bash
     1436 pts/0    R+     0:00      \_ ps -x --forest
     1092 tty1     S+     0:00 -bash
     1080 ?        Ss     0:00 /lib/systemd/systemd --user
     1081 ?        S      0:00  \_ (sd-pam)

   The command ps aux --forest shows all processes with a tree view and extended details such as CPU and memory usage.

   Manual: ps manual

4. Install pstree from the distribution package repository if it is not available.

   $ sudo apt update && sudo apt install --assume-yes psmisc

   On CentOS, Red Hat, and Fedora, install psmisc with

   $ sudo dnf install --assumeyes psmisc

   .

5. Use the pstree command to view the full process tree.

   $ pstree
   systemd─┬─VGAuthService
           ├─accounts-daemon───2*[{accounts-daemon}]
           ├─atd
           ├─cron
           ├─dbus-daemon
           ├─login───bash
           ├─multipathd───6*[{multipathd}]
           ├─networkd-dispat
           ├─packagekitd───2*[{packagekitd}]
           ├─polkitd───2*[{polkitd}]
           ├─rsyslogd───3*[{rsyslogd}]
           ├─snapd───8*[{snapd}]
           ├─sshd───sshd───sshd───bash───pstree
           ├─systemd───(sd-pam)
           ├─systemd-journal
           ├─systemd-logind
           ├─systemd-network
           ├─systemd-resolve
           ├─systemd-timesyn───{systemd-timesyn}
           ├─systemd-udevd
           ├─unattended-upgr───{unattended-upgr}
           └─vmtoolsd───{vmtoolsd}

   The option pstree -p adds process IDs to each entry, which is useful when correlating with logs or tools like top and htop.

6. Display additional pstree options when a different layout or sorting is needed.

   More options for pstree:

   Usage: pstree [-acglpsStuZ] [ -h | -H PID ] [ -n | -N type ]
                 [ -A | -G | -U ] [ PID | USER ]
          pstree -V
   Display a tree of processes.
   
     -a, --arguments     show command line arguments
     -A, --ascii         use ASCII line drawing characters
     -c, --compact       don't compact identical subtrees
     -h, --highlight-all highlight current process and its ancestors
     -H PID,
     --highlight-pid=PID highlight this process and its ancestors
     -g, --show-pgids    show process group ids; implies -c
     -G, --vt100         use VT100 line drawing characters
     -l, --long          don't truncate long lines
     -n, --numeric-sort  sort output by PID
     -N type,
     --ns-sort=type      sort by namespace type (cgroup, ipc, mnt, net, pid,
                                                 user, uts)
     -p, --show-pids     show PIDs; implies -c
     -s, --show-parents  show parents of the selected process
     -S, --ns-changes    show namespace transitions
     -t, --thread-names  show full thread names
     -T, --hide-threads  hide threads, show only processes
     -u, --uid-changes   show uid transitions
     -U, --unicode       use UTF-8 (Unicode) line drawing characters
     -V, --version       display version information
     -Z, --security-context
                         show SELinux security contexts
     PID    start at this PID; default is 1 (init)
     USER   show only trees rooted at processes of this user

   Manual: pstree - display a tree of processes