How To

pstree Command in Linux: Visualize Running Process Hierarchies

The pstree command in Linux displays running processes in a tree structure rather than a flat list. The parent-child relationships that ps shows as columns are immediately visible here — making it easier to understand how processes are related and which process spawned which.

How to Use the pstree Command in Linux

The syntax is:

bashpstree [OPTIONS] [USER or PID]

Run without arguments to see the full process tree:

bashpstree

The root of the tree is the parent of all running processes. On modern Linux systems this is systemd — the first process that starts at boot (PID 1). Every other process on the system is a descendant of it.

Merging notation. When multiple identical processes exist, pstree collapses them into a compact form:

├─2*[agetty]

This is equivalent to two separate agetty lines. The integer prefix shows how many identical branches were merged. To expand merged branches and show each process individually, use -c.

Threads appear under their parent process inside curly braces: {process_name}. These are threads within that process, not separate child processes. Use -t to show full thread names, or -T to hide threads entirely and show only processes.

pstree output is often longer than the terminal. Pipe it to less to scroll through it:

bashpstree | less

Show PIDs, PGIDs, and Command Arguments

Show PIDs with -p. PIDs appear in parentheses after each process name:

bashpstree -p

When -p is active, merging is implicitly disabled. Each process entry must be unique to display its own PID, so the compact n*[process] notation cannot be used.

Sort by PID instead of alphabetically with -n. Combine it with -p to get a numerically sorted tree with PIDs visible:

bashpstree -pn

Show PGIDs with -g. The process group ID (PGID) is the PID of the first member of the process group. Threads within the same process share the same PGID as their parent — which is why all threads of a process show identical values in the PGID column.

bashpstree -g

Show command-line arguments with -a. This reveals exactly how each process was started — useful when multiple instances of the same program are running with different options:

bashpstree -a

Filter by User or PID and Highlight Processes

Filter to a specific user. Pass a username as an argument to show only that user’s processes:

bashpstree linuxize

Root the tree at a specific PID. Pass a PID as an argument to show only that process and its descendants:

bashpstree 1943

Show the ancestor chain of a specific PID with -s. This goes in the opposite direction — upward from the given process to the root:

bashpstree -s 1943

Output: systemd───sshd───sshd───bash───pstree

This shows the full path from that process back to systemd.

Highlight processes with -h to mark the current process and all its ancestors up to the root. To highlight a specific PID instead:

bashpstree -H 1943

If the terminal does not support highlighting, the command exits with an error.

Use pstree for a quick hierarchy view, -p to add PIDs, -s to trace a process’s ancestors, and -T when you only want to see processes. For a more detailed flat view with CPU and memory columns, use ps. Leave a comment below if you run into any issues.

Cyber Defence

Recent Posts

jobs Command in Linux: List and Manage Background Processes

The jobs command is a Bash builtin that lists all background and suspended processes belonging to the…

44 minutes ago

dmesg Command in Linux: Read and Filter Kernel Messages

The Linux kernel writes messages to the kernel ring buffer throughout the boot process and…

49 minutes ago

How to Transfer Files with rsync over SSH: A Practical Guide

rsync over SSH combines secure encrypted transport with fast incremental transfers. Instead of copying every file…

60 minutes ago

type Command in Linux: Show How the Shell Resolves a Name

The type command in Linux shows how the current shell would interpret a name typed on the…

23 hours ago

How to Check Memory Usage in Linux: free, top, and /proc/meminfo

When a Linux system is slow or behaving unexpectedly, memory is one of the first…

23 hours ago

ip Command in Linux: Configure Interfaces, Routes, and ARP

The ip command is the standard network configuration tool on modern Linux systems. It is part of…

23 hours ago