How To

pstree Command in Linux: Visualize Running Process Hierarchies

The pstree command in Linux displays running processes in a tree structure rather than a flat list. The parent-child relationships that ps shows as columns are immediately visible here — making it easier to understand how processes are related and which process spawned which.

How to Use the pstree Command in Linux

The syntax is:

bashpstree [OPTIONS] [USER or PID]

Run without arguments to see the full process tree:

bashpstree

The root of the tree is the parent of all running processes. On modern Linux systems this is systemd — the first process that starts at boot (PID 1). Every other process on the system is a descendant of it.

Merging notation. When multiple identical processes exist, pstree collapses them into a compact form:

├─2*[agetty]

This is equivalent to two separate agetty lines. The integer prefix shows how many identical branches were merged. To expand merged branches and show each process individually, use -c.

Threads appear under their parent process inside curly braces: {process_name}. These are threads within that process, not separate child processes. Use -t to show full thread names, or -T to hide threads entirely and show only processes.

pstree output is often longer than the terminal. Pipe it to less to scroll through it:

bashpstree | less

Show PIDs, PGIDs, and Command Arguments

Show PIDs with -p. PIDs appear in parentheses after each process name:

bashpstree -p

When -p is active, merging is implicitly disabled. Each process entry must be unique to display its own PID, so the compact n*[process] notation cannot be used.

Sort by PID instead of alphabetically with -n. Combine it with -p to get a numerically sorted tree with PIDs visible:

bashpstree -pn

Show PGIDs with -g. The process group ID (PGID) is the PID of the first member of the process group. Threads within the same process share the same PGID as their parent — which is why all threads of a process show identical values in the PGID column.

bashpstree -g

Show command-line arguments with -a. This reveals exactly how each process was started — useful when multiple instances of the same program are running with different options:

bashpstree -a

Filter by User or PID and Highlight Processes

Filter to a specific user. Pass a username as an argument to show only that user’s processes:

bashpstree linuxize

Root the tree at a specific PID. Pass a PID as an argument to show only that process and its descendants:

bashpstree 1943

Show the ancestor chain of a specific PID with -s. This goes in the opposite direction — upward from the given process to the root:

bashpstree -s 1943

Output: systemd───sshd───sshd───bash───pstree

This shows the full path from that process back to systemd.

Highlight processes with -h to mark the current process and all its ancestors up to the root. To highlight a specific PID instead:

bashpstree -H 1943

If the terminal does not support highlighting, the command exits with an error.

Use pstree for a quick hierarchy view, -p to add PIDs, -s to trace a process’s ancestors, and -T when you only want to see processes. For a more detailed flat view with CPU and memory columns, use ps. Leave a comment below if you run into any issues.

Cyber Defence

Recent Posts

What I Wish I Knew Before Learning Malware Analysis and Reverse Engineering

When I first started learning malware analysis and reverse engineering, I thought the hardest part…

2 days ago

git fetch vs git pull: How They Work and When to Use Each

Both git fetch and git pull talk to a remote repository, but they do very different things to your…

2 weeks ago

git cherry-pick Command: Apply Commits from Another Branch

Sometimes the change you need already exists, just on the wrong branch. A hotfix lands…

2 weeks ago

Best Email APIs for Secure Business Email: Why Developers Are Moving Beyond SMTP

Email is still one of the most important communication channels inside modern applications. Password resets,…

2 weeks ago

Nginx Commands in Linux: Start, Stop, Reload, Test, and Log

Nginx is a high-performance web server and reverse proxy trusted by some of the largest…

2 weeks ago

ufw Command in Linux: Manage Firewall Rules with Examples

ufw (Uncomplicated Firewall) sits on top of iptables (or nftables on newer systems) and replaces…

2 weeks ago