How to Use the pstree Command to Visualize Process Hierarchies in Linux

If you’ve ever tried to make sense of the running processes on your Linux system using ps or top, you’ve probably noticed how overwhelming those lists can get. With dozens-or sometimes hundreds-of processes spinning in the background, it’s easy to lose track of what’s related to what. That’s where the pstree command comes in handy. This clever little tool presents all running processes in the form of a tree, showing you clearly which processes started others and how they’re all connected.

In this guide, you’ll learn not just how to install and use pstree, but also why it’s such a valuable tool for troubleshooting, monitoring, and understanding what’s happening under the hood of your Linux machine. By the end, you’ll have a solid grasp of process hierarchies, and you’ll be able to spot and diagnose problems with confidence.

Prerequisites

Before you begin, make sure you have:

• Access to a Linux system
• A terminal or SSH connection
• Basic familiarity with the command line

No special permissions are required unless you want to see processes belonging to other users.

Why Visualize Process Hierarchies?

Understanding the relationships between processes is at the heart of Linux system administration. Every time you open a terminal, launch a program, or even just log in, Linux creates new processes. Each process is assigned a unique process ID (PID) and is typically started by another process (its “parent”). This parent-child relationship forms a tree structure, starting with the first process that’s launched when your system boots up.

Imagine this: You log in to your system, which launches your default shell. From there, you might start editing a file in Vim, compiling code, or running a script-all of which become child processes of your shell. If any of these spawn background jobs, the tree keeps branching out.

Most process management tools show you lists, but they don’t show you these relationships. That’s what makes pstree so useful; it shows you the “family tree” of your processes at a glance.

Installing pstree

Chances are, pstree is already installed on your system. If not, installation is straightforward.

On Ubuntu or Debian

sudo apt update
sudo apt install psmisc

The psmisc package includes pstree.

On Fedora, CentOS, or RHEL

sudo dnf install psmisc

or, for older systems:

sudo yum install psmisc

Confirming Installation

Check if pstree is available by running:

pstree --version

You should see the version information, confirming that the installation was successful.

Getting to Know pstree

Using pstree is as simple as typing its name in the terminal:

pstree

This command brings up a tree diagram of all the active processes on your machine. The output is visual and, at first glance, might look like a piece of abstract art. Here’s a sample snippet:

systemd─┬─NetworkManager───2*[{NetworkManager}]
         ├─accounts-daemon───2*[{accounts-daemon}]
         ├─cron
         ├─dbus-daemon
         ├─sshd───sshd───bash───pstree
         └─...

In this example, systemd (the process with PID 1) is at the very top. Every other process is a descendant, directly or indirectly, of systemd. Indented lines and connecting branches show you how processes are “related.”

Showing PIDs

Sometimes, you need more than just the names; you want to see process IDs too. Add the -p option:

pstree -p

Now, each process is listed with its PID in parentheses, like this:

systemd(1)─┬─NetworkManager(772)
            ├─sshd(897)───sshd(1422)───bash(1423)───pstree(1440)
            └─...

This comes in handy when you’re tracking down a runaway process or matching up output from other tools like ps or top.

Viewing a Specific User’s Processes

If you’re on a multi-user system, or just want to see what a particular user is running, specify the username:

pstree alice

This shows only Alice’s processes and their subtree.

Focusing on One Process

Maybe you know the PID of a process and want to see its children. Just run:

pstree 1234

Replace 1234 with the PID you’re investigating.

Customizing the Output

pstree is a flexible tool, and you can tailor its display to your needs.

ASCII Output

If your terminal doesn’t handle line-drawing characters well, or you want a more basic display, use the -A option:

pstree -A

This replaces the fancy lines with simple ASCII characters.

Viewing Threads

By default, threads are usually shown in curly braces, but you can emphasize them with the -T option:

pstree -T

This makes it easier to spot multi-threaded processes.

Highlighting Your Own Processes

If you want to quickly see which processes belong to you, use:

pstree -u

Your processes will be highlighted, making them stand out from the rest.

Color Output

Some versions of pstree include color highlighting with the -c flag:

pstree -c

This feature depends on your terminal’s capabilities, but if supported, it adds an extra layer of readability.

Real-World Scenarios: When pstree Makes a Difference

Let’s look at some common situations where pstree shines.

1. Tracking Down Orphaned or Zombie ProcessesHave you ever noticed your system feeling sluggish, only to discover a mysterious process eating up CPU or memory? Sometimes, programs crash or hang, leaving behind “orphaned” or “zombie” processes. With pstree, you can spot these easily because they often show up disconnected or with unusual parentage.

   For instance, if you see a process hanging directly off systemd, it may have lost its parent. Investigating further could reveal a misbehaving application or script.

2. Understanding How Services are StructuredSuppose you’re running a web server like Apache or Nginx. These services often spawn multiple worker processes. Instead of scrolling through long lists with ps, use pstree to see how the main service process (like apache2 or nginx) spawns its children. This is especially useful when troubleshooting resource leaks or performance problems.

   pstree -p | grep apache

   This displays the parent-child structure of all Apache processes.

3. Auditing User SessionsIf you’re a system administrator and someone’s session seems suspicious, use:

   pstree username

   Replace username with the actual user. You’ll quickly see all processes tied to that session, including any background jobs or scripts.

4. Investigating Shell and Script BehaviorEver wondered what happens when you run a shell script that launches other commands? Open a terminal, run your script, and in another terminal, run pstree with the -p flag. You’ll see the parent shell, the script, and all child processes in action.

Combining pstree with Other Tools

pstree is even more powerful when used alongside other Linux utilities.

Combine with grep to filter for a specific process or keyword:

pstree -p | grep python

Use with watch if you want a real-time, constantly updating view:

watch pstree -p

Redirect Output Need to save the tree for documentation or later review?

pstree -p > process_tree.txt

Remote Usage Over SSH Monitor a remote system’s processes:

ssh user@remotehost 'pstree -p'

Troubleshooting Example: Diagnosing a Stuck Web Application

Let’s walk through a real-world example. Imagine your web application becomes unresponsive. You suspect a script or background process is to blame, but you’re unsure which one.

Check the parent web service process first, find the parent process for your web server (e.g., Apache).

pstree -p | grep apache

Locate problematic children. Look for child processes that seem unusual-perhaps one is consuming much more memory than the others, or has been running much longer.

Investigate further. Use ps, top, or htop with the PID to gather more details. If needed, kill the problematic process while leaving the main service running.

This approach is much faster and clearer than hunting through process lists.

How pstree Differs from Other Tools

You might be wondering how pstree compares to tools like ps, top, or htop.

• ps is flexible and detailed but presents processes in a list, making relationships hard to see.
• top and htop are interactive and show resource usage, but only htop offers a tree view (press F5).
• pstree provides instant visualization of process parentage and is especially useful for static snapshots and quick overviews.

Best Practices for Using pstree

Run pstree regularly to familiarize yourself with your system’s normal process tree.

When troubleshooting, start with broad output and narrow down using usernames or PIDs.

Use the output in combination with ps, htop, and log files for a complete picture.

For scripting or automation, consider capturing the output at regular intervals for later comparison.

Scripting with pstree

If you manage servers or want to automate process monitoring, you can use pstree in scripts. For instance, schedule a cron job to record the process tree every hour:

0 * * * * /usr/bin/pstree -p > /var/log/pstree_hourly.txt

This creates a historical record, which can be invaluable when tracking down intermittent issues.

Security and Privacy Considerations

While pstree is safe, remember that process lists may contain sensitive information, such as command-line arguments. Avoid publishing full outputs from production systems, and run the command with elevated privileges only when absolutely necessary.

Frequently Asked Questions

Can You Use pstree on MacOS?
Yes, you can! It’s not included by default, but you can install it via Homebrew:

brew install pstree

What’s the Difference Between Threads and Processes in pstree?
Threads are shown in curly braces. They’re lightweight units of execution within a process, sharing memory space. Processes are independent and have their own memory.

How Can You Search for a Specific Process in the Tree?
Use grep to filter the output, e.g.:

pstree -p | grep nginx

Conclusion

Understanding your Linux system’s process hierarchy is crucial for both troubleshooting and day-to-day administration. The pstree command offers a bird’s-eye view of everything that’s happening, allowing you to spot problems, audit sessions, and get a feel for how services and applications are structured.

Next time you’re faced with a slow system, a stuck script, or just plain curiosity, fire up pstree and see what’s really going on. With practice, you’ll find it an indispensable tool in your Linux toolkit.