Cybersecurity Updates & Tools

pstree Command in Linux: Visualize Running Process Hierarchies

The pstree command in Linux displays running processes in a tree structure rather than a flat list. The parent-child relationships that ps shows as columns are immediately visible here — making it easier to understand how processes are related and which process spawned which.

How to Use the pstree Command in Linux

The syntax is:

bashpstree [OPTIONS] [USER or PID]

Run without arguments to see the full process tree:

bashpstree

The root of the tree is the parent of all running processes. On modern Linux systems this is systemd — the first process that starts at boot (PID 1). Every other process on the system is a descendant of it.

Merging notation. When multiple identical processes exist, pstree collapses them into a compact form:

├─2*[agetty]

This is equivalent to two separate agetty lines. The integer prefix shows how many identical branches were merged. To expand merged branches and show each process individually, use -c.

Threads appear under their parent process inside curly braces: {process_name}. These are threads within that process, not separate child processes. Use -t to show full thread names, or -T to hide threads entirely and show only processes.

pstree output is often longer than the terminal. Pipe it to less to scroll through it:

bashpstree | less

Show PIDs, PGIDs, and Command Arguments

Show PIDs with -p. PIDs appear in parentheses after each process name:

bashpstree -p

When -p is active, merging is implicitly disabled. Each process entry must be unique to display its own PID, so the compact n*[process] notation cannot be used.

Sort by PID instead of alphabetically with -n. Combine it with -p to get a numerically sorted tree with PIDs visible:

bashpstree -pn

Show PGIDs with -g. The process group ID (PGID) is the PID of the first member of the process group. Threads within the same process share the same PGID as their parent — which is why all threads of a process show identical values in the PGID column.

bashpstree -g

Show command-line arguments with -a. This reveals exactly how each process was started — useful when multiple instances of the same program are running with different options:

bashpstree -a

Filter by User or PID and Highlight Processes

Filter to a specific user. Pass a username as an argument to show only that user’s processes:

bashpstree linuxize

Root the tree at a specific PID. Pass a PID as an argument to show only that process and its descendants:

bashpstree 1943

Show the ancestor chain of a specific PID with -s. This goes in the opposite direction — upward from the given process to the root:

bashpstree -s 1943

Output: systemd───sshd───sshd───bash───pstree

This shows the full path from that process back to systemd.

Highlight processes with -h to mark the current process and all its ancestors up to the root. To highlight a specific PID instead:

bashpstree -H 1943

If the terminal does not support highlighting, the command exits with an error.

Use pstree for a quick hierarchy view, -p to add PIDs, -s to trace a process’s ancestors, and -T when you only want to see processes. For a more detailed flat view with CPU and memory columns, use ps. Leave a comment below if you run into any issues.