Skip to content
shellmap

Show the process tree

Render the parent/child relationships between running processes — useful for tracing rogue children, debugging fork bombs, and understanding shell-spawned subprocess chains.

How to show the process tree in each shell

Bashunix
pstree -p

`-p` shows PIDs alongside each process. `pstree` is in `psmisc` on Debian/Ubuntu, base install on Fedora, `brew install pstree` on macOS. `-a` shows command-line args; `-s PID` shows ancestors of a specific PID.

Zshunix
pstree -p
Fishunix
pstree -p
PowerShellwindows
Get-CimInstance Win32_Process | Select-Object ProcessId, ParentProcessId, Name, CommandLine | Sort-Object ParentProcessId, ProcessId | Format-Table

`Win32_Process` exposes `ParentProcessId` (which `Get-Process` does NOT). For a true tree render, recurse: define a function that groups by `ParentProcessId` and prints children indented. Or install `PSTree` from the gallery: `Install-Module PSTree; Get-PSTree`.

cmd.exewindows
wmic process get ProcessId,ParentProcessId,Name,CommandLine /format:list

`wmic` is DEPRECATED on Windows 11 24H2+ (no longer installed by default). Use PowerShell `Get-CimInstance Win32_Process` instead — same WMI query, modern surface, still ships everywhere.

Equivalents listed for Bash, Zsh, Fish, PowerShell, cmd.exe.

Gotchas & notes

  • **`pstree` is NOT in base macOS**: `brew install pstree` (proctools package) installs a BSD-ish port that's missing several GNU flags. Portable alternative: `ps -ejH` (POSIX — `-e` all processes, `-j` job control format showing PPID, `-H` shows hierarchy via indentation). Output is less pretty than `pstree` but always present. macOS `ps -axwwo pid,ppid,user,command | awk '{ printf "%s\t%s\t%s\t%s\n", $1, $2, $3, substr($0, index($0,$4)) }'` for full command lines without truncation.
  • **Linux: `ps -ejH` vs `ps fauxw` vs `pstree -p $$`** — three idioms that look similar but differ: `-H` (hierarchical, indented under parents) requires the process list itself to be sorted by PPID then PID for the indents to read sensibly (which `ps -ejH` does). `ps f` (BSD-style, `auxf`) adds ASCII art (`└─` / `├─`) — closer to `pstree` output but only one level of children per line. `pstree -p $$` shows the tree starting from your CURRENT shell upward and downward — useful for "show me the chain that led to this shell" (login → sshd → bash → cmd).
  • **Windows tree-walking** is harder because `Get-Process` only returns the process objects without PPID; you must `Get-CimInstance Win32_Process` or `Get-WmiObject Win32_Process` (the latter is deprecated in PowerShell 7 — use `Get-CimInstance`). Quick parent-of-current-PID: `(Get-CimInstance Win32_Process -Filter "ProcessId = $PID").ParentProcessId`. For full hierarchical render install the community module: `Install-Module PSTree -Scope CurrentUser; Get-PSTree -IncludeUser`. SysInternals' `pslist -t` (`pslist.exe -t`) gives a tree view from the command line — single executable, no install.
  • **Interactive tree views**: `htop` press F5 to toggle tree mode (collapses/expands branches with `+`/`-`). `btop` defaults to a sortable list — press `e` to toggle tree mode. `procs` (Rust replacement for `ps`, `cargo install procs`) has `--tree` flag plus colored output. Windows: Task Manager → Details tab → right-click column → Add "Parent PID" — gives sortable view. Process Explorer (SysInternals) shows full tree natively, drag-and-drop hierarchy, plus per-process icons.
  • **Finding orphans and re-parented processes**: in Linux, a process whose parent died is re-parented to PID 1 (`init` / `systemd`) — appears as a child of PID 1 in `pstree`. On modern systemd, user sessions might be re-parented to `systemd --user` (varies). On macOS `launchd` (PID 1) gets the orphans similarly. Filter "anything reparented" with `ps -eo pid,ppid,comm | awk '$2 == 1 && $1 != 1'`. On Windows, orphans are NOT re-parented — the PPID just becomes invalid. `Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -and -not (Get-Process -Id $_.ParentProcessId -ErrorAction SilentlyContinue) }` finds them.

Related commands

Related tasks