How do you find the parent process of a zombie process?

Question

How do you find the parent process of zombie processes?

When the child process is something where the parent is not entirely obvious...

Is there some way to list processes in tree format or something?

Answer 1

Add the l option to your ps command line. This is the option for long output. The parent process id is one of the additional columns -- labeled PPID.

$ ps l
F   UID   PID  PPID PRI  NI    VSZ   RSS WCHAN  STAT TTY        TIME COMMAND
0   508  3344  4498  18   0   2452  1236 wait   Ss   pts/12     0:00 /bin/sh
0   508  4467 17796  15   0   4664  1572 wait   Ss   pts/5      0:00 -/bin/bash
0   508  4498  4467  15   0  23032 15108 -      S+   pts/5      2:20 emacs -nw
0   508  4532 17796  15   0   4532  1464 wait   Ss   pts/13     0:00 -/bin/bash
0   508  4916 17796  15   0   4664  1648 wait   Ss   pts/7      0:01 -/bin/bash

Another option is the pstree command to show an ascii tree representation of the processes. You'll probably want the -p option to show process ids.

$ pstree -p dharris
screen(17796)─┬─bash(4467)───emacs(4498)───sh(3344)───sh(3345)
              ├─bash(4532)───su(31037)───bash(31041)
              ├─bash(4916)───pstree(26456)
              ├─bash(13547)───su(20442)───bash(20443)
              └─bash(17797)

sshd(25813)───bash(25817)───screen(25870)

Answer 2

FWIW, ps has a "forest" mode that shows multiple trees:

# ps --version
procps version 3.2.8

# ps f
  PID TTY      STAT   TIME COMMAND
 7889 pts/7    Ss     0:00 -bash
 7988 pts/7    R+     0:00  \_ ps f
 2447 pts/0    Ss+    0:00 -bash
 2532 pts/0    S      0:00  \_ /bin/bash /home/robmee01/sync.sh
 2548 pts/0    S      0:00  |   \_ ssh [e-mail]
 2533 pts/0    S      0:00  \_ python /home/robmee01/IE2FF.py
 2534 pts/0    S      0:08  \_ x11vnc -usepw -forever
 2535 pts/0    S      2:47  \_ xosview
 2536 pts/0    Sl     0:17  \_ java -jar /work/timesheet/TimeSheet.jar
 2662 pts/0    Sl    18:53  \_ ./firefox-bin

If that doesn't display the process you are looking for, try specifying your username explicitly: ps f -U $USER; this tends to show more processes than plain-old ps.

Personally I use ps fo pid,cmd or to get a forest view with my choice of columns (pid,cmd in this case). You can get a full list of columns with ps L.

Answer 3

htop is also good, especially when pressing l on a process name which will show all open files, pipes and urls for a process (requires lsof)

Answer 4

First use top to find out the pid of the zombie process. Then run ps -elf or ps -ef to find the ppid of the zombie.