Viewing information and processes as bushes on Linux

A take a look at three Linux instructions – ps, pstree and tree – for viewing information and processes in a tree-like format.

Linux supplies a number of useful instructions for viewing each information and processes in a branching, tree-like format that makes it straightforward to view how they’re associated. On this submit, we’ll take a look at the ps, pstree and tree instructions together with some choices they supply to assist focus your view on what you wish to see.

ps

The ps command that all of us use to checklist processes has some attention-grabbing choices that many people by no means reap the benefits of. Whereas the generally used ps -ef supplies an entire itemizing of operating processes, the ps -ejH command provides a pleasant impact. It indents associated processes to make the connection between these processes visually extra clear – as on this excerpt:

$ ps -ejH
PID PGID SID TTY TIME CMD

1396 1396 1396 ? 00:00:00 sshd
28281 28281 28281 ? 00:00:00 sshd
28409 28281 28281 ? 00:00:00 sshd
28410 28410 28410 pts/0 00:00:00 bash
30968 30968 28410 pts/0 00:00:00 ps

As you possibly can see, the ps course of is being run is run inside bash and bash inside an ssh session.

The -exjf choice string supplies an analogous view, however with some further particulars and symbols to spotlight the hierarchical nature of the processes:

$ ps -exjf
PPID PID PGID SID TTY TPGID STAT UID TIME COMMAND

1 1396 1396 1396 ? -1 Ss Zero 0:00 /usr/sbin/sshd -D
1396 28281 28281 28281 ? -1 Ss Zero 0:00 _ sshd: shs [priv]
28281 28409 28281 28281 ? -1 S 1000 0:00 _ sshd: shs@pts/0
28409 28410 28410 28410 pts/0 31028 Ss 1000 0:00 _ -bash
28410 31028 31028 28410 pts/0 31028 R+ 1000 0:00 _ ps axjf

The choices utilized in these instructions characterize:

-e choose all processes
-j use the roles format
-f present a full format itemizing
-H present the method hierarchy (i.e., the “forest format”)
-x elevate the “should be related to a tty” restriction

There’s additionally a –forest choice that gives an analogous view.

$ ps -ef –forest
UID PID PPID C STIME TTY TIME CMD

root 1396 1 Zero Oct08 ? 00:00:00 /usr/sbin/sshd -D
root 28281 1396 0 12:55 ? 00:00:00 _ sshd: shs [priv]
shs 28409 28281 0 12:56 ? 00:00:00 _ sshd: shs@pts/0
shs 28410 28409 0 12:56 pts/0 00:00:00 _ -bash
shs 32351 28410 0 14:39 pts/0 00:00:00 _ ps -ef –forest

Word that these examples are solely a sampling of how these instructions can be utilized. You may choose whichever choices that provide the view of processes that works greatest for you.

pstree

The same view of processes is offered utilizing the pstree command. Whereas even pstree gives many choices, the command supplies a really helpful show by itself. Discover that many parent-child course of relationships are displayed on single strains moderately than subsequent strains.

$ pstree

├─sshd───sshd───sshd───bash───pstree
├─systemd─┬─(sd-pam)
│ ├─at-spi-bus-laun─┬─dbus-daemon
│ │ └─3*[]
│ ├─at-spi2-registr───2*[]
│ ├─dbus-daemon
│ ├─ibus-portal───2*[]
│ ├─pulseaudio───2*[]
│ └─xdg-permission-───2*[]

With the -n choice, pstree shows the method in numerical (by course of ID) order:

$ pstree -n
systemd─┬─systemd-journal
├─systemd-udevd
├─systemd-timesyn───
├─systemd-resolve
├─systemd-logind
├─dbus-daemon
├─atopacctd
├─irqbalance───
├─accounts-daemon───2*[]
├─acpid
├─rsyslogd───3*[]
├─freshclam
├─udisksd───4*[]
├─networkd-dispat
├─ModemManager───2*[]
├─snapd───10*[]
├─avahi-daemon───avahi-daemon
├─NetworkManager───2*[]
├─wpa_supplicant
├─cron
├─atd
├─polkitd───2*[]
├─colord───2*[]
├─unattended-upgr───
├─sshd───sshd───sshd───bash───pstree

Some choices to contemplate when utilizing pstree embrace -a (embrace command line arguments) and -g (embrace course of teams).

Listed here are some fast (truncated) examples.

Output from pstree -a

└─wpa_supplicant -u -s -O /run/wpa_supplicant

Output from pstree -g:

├─sshd(1396)───sshd(28281)───sshd(28281)───bash(28410)───pstree(1115)

tree

Whereas the tree command seems like it could be similar to pstree, it is a command for information moderately than processes. It supplies a pleasant tree-like view of directories and information.

Should you use the tree command to have a look at /proc, your show would start much like this one:

$ tree /proc
/proc
├── 1
│ ├── attr
│ │ ├── apparmor
│ │ │ ├── present
│ │ │ ├── exec
│ │ │ └── prev
│ │ ├── present
│ │ ├── show
│ │ ├── exec
│ │ ├── fscreate
│ │ ├── keycreate
│ │ ├── prev
│ │ ├── smack
│ │ │ └── present
│ │ └── sockcreate
│ ├── autogroup
│ ├── auxv
│ ├── cgroup
│ ├── clear_refs
│ ├── cmdline

You will note much more element should you run a command like this as root (sudo tree /proc) since a lot of the contents of /proc is inaccessible to common customers.

The tree -d command will restrict your show to directories.

$ tree -d /proc
/proc
├── 1
│ ├── attr
│ │ ├── apparmor
│ │ └── smack
│ ├── fd [error opening dir]
│ ├── fdinfo [error opening dir]
│ ├── map_files [error opening dir]
│ ├── web
│ │ ├── dev_snmp6
│ │ ├── netfilter
│ │ └── stat
│ ├── ns [error opening dir]
│ └── process
│ └── 1
│ ├── attr
│ │ ├── apparmor
│ │ └── smack

With the -f choice, tree will present full pathnames.

$ tree -f /proc
/proc
├── /proc/1
│ ├── /proc/1/attr
│ │ ├── /proc/1/attr/apparmor
│ │ │ ├── /proc/1/attr/apparmor/present
│ │ │ ├── /proc/1/attr/apparmor/exec
│ │ │ └── /proc/1/attr/apparmor/prev
│ │ ├── /proc/1/attr/present
│ │ ├── /proc/1/attr/show
│ │ ├── /proc/1/attr/exec
│ │ ├── /proc/1/attr/fscreate
│ │ ├── /proc/1/attr/keycreate
│ │ ├── /proc/1/attr/prev
│ │ ├── /proc/1/attr/smack
│ │ │ └── /proc/1/attr/smack/present
│ │ └── /proc/1/attr/sockcreate

Hierarchical shows can usually make the connection between processes and information simpler to know. Whereas the variety of choices accessible is moderately broad, you may most likely discover some views that aid you see simply what you are searching for.

Be part of the Community World communities on

Fb

and

LinkedIn

to touch upon matters which might be high of thoughts.

Supply

Germany Devoted Server

Leave a Reply