Linux ppid and pid

What is the difference between a Process’ pid, ppid, uid, euid, gid and egid?

In Linux, an executable stored on disk is called a program, and a program loaded into memory and running is called a process. When a process is started, it is given a unique number called process ID (PID) that identifies that process to the system. If you ever need to kill a process, for example, you can refer to it by its PID.

In addition to a unique process ID, each process is assigned a parent process ID (PPID) that tells which process started it. The PPID is the PID of the process’s parent.

For example, if process1 with a PID of 101 starts a process named process2, then process2 will be given a unique PID, such as 3240, but it will be given the PPID of 101. It’s a parent-child relationship. A single parent process may spawn several child processes, each with a unique PID but all sharing the same PPID.

Unix-like operating systems identify users within the kernel by a value called a user identifier, often abbreviated to UID or User ID. The UID, along with the GID and other access control criteria, is used to determine which system resources a user can access. The password file maps textual usernames to UIDs, but in the kernel, only UID’s are used.

The effective UID (euid) of a process is used for most access checks. It is also used as the owner for files created by that process.

A group identifier, often abbreviated to GID, is a numeric value used to represent a specific group. The range of values for a GID varies amongst different systems; at the very least, a GID can be between 0 and 32,767, with one restriction: the login group for the superuser must have GID 0.

The effective GID (egid) of a process also affects access control and may also affect file creation, depending on the semantics of the specific kernel implementation in use and possibly the mount options used.

Refer these articles for more information:

Источник

Differences Between PID, TID and PPID in Linux

A Linux operating system provides the perfect environmental exposure for users to understand the Ins and Outs of process management. The simplest definition of a process is any program in execution (running).

For instance, the web browser you are using to read this article piece only becomes a process once that web browser is up and running. Before your web browser was installed and launched, it only existed as a program (a process in waiting).

When you dive deeper into the concept of process management, you will get to acknowledge the various properties associated with processes. This article will walk us through differentiating three processes’ properties namely: PID, TID, and PPID.

Background Information on Process Management

In order to distinctively understand and differentiate the processes mentioned above’ properties, we need to understand process management from a parallel computing perspective.

In parallel computing, allocated and purpose-driven resources such as file descriptors and memory space qualify as a valid definition of a process.

Most minor instructions set associated with and manipulated by processes are called threads. A scheduler handles these threads.

• Multithreading and multiprocessing are parallel computing concepts since these programming techniques support the simultaneous performance of multiple operations.
• Under multithreading, a scheduler assigns different tasks to multiple threads associated with a single process. The memory resources allocated to this single process are therefore shared among multiple threads present.
• Under multiprocessing, a single parent process is associated with multiple child processes. Here, process communication is not as efficient as thread communication when sharing resources hence the need for explicit declaration.

Defining PID, TID, and PPID

By default, these three highlighted process properties are identifiers. Let us define them one by one.

• PID (Process Identifier) – Every running process accounted for by the system kernel is identified by a unique number called the process identifier. The systemd is associated with PID 1.
• TID (Thread Identifier) – This number (integer) uniquely identifies threads associated with a process or processes. When there is only one thread; like in the case of serial programming, TID and PID become indistinguishable. TID is only different from PID in multi-thread environments since each thread is assigned a unique TID. Also, note that threads attached to the same process share the PID.
• PPID (Parent Process Identifier) – When a multiprocessing sequence is triggered by a program, a parent process comes into existence which then (the parent process) consequently initiates/facilitates the creation of numerous child processes. PPID uniquely identifies the parent process. The child processes share the PPID but will have different and unique PIDs. PPID helps link child processes to their associated parent process.

Getting a Known Process PID in Linux

The command pidof helps us identify the PID associated with a named process. For instance, we can query the PID associated with a running Brave web browser.

The output implies that this process is associated with numerous PIDs.

Getting a Known PID’s TIDs

There are two approaches to achieving this objective:

1. Querying /proc/PID/task File

Let us take a PID from the execution of the above pidof command.

The /proc/… directory accounts for each running process based on its PID and the …/task directory accounts for the TIDs associated with each PID. As you might have noted, the TID value will either be equal to/greater than the PID value.

2. Using ps Command

Here, we use the ps command together with the —pid and tid flags.

$ ps --pid 3410 -O tid,lwp,nlwp -L

LWP denotes Light Weight Process and NLWP counts them.

Getting a Known TID’s PID

The first approach is to query the /proc/… directory using the readlink command. You have to specify the TID number in the command.

$ readlink -f /proc/*/task/4346 | cut -d/ -f3

Alternatively, the ps command should also work. We however need to pipe its query to an awk command for it to print to the standard output the queried info.

$ ps -e -O tid -L | awk '$2 == 4346'

Getting a Known PID’s PPID

We can reference the /proc/PID/status directory using the cat command and then pipe the results to the grep command which then retrieves the PID’s PPID.

$ cat /proc/3389/status | grep PPid

The ps command can also retrieve a PID’s PPID where the -O flag redirects the retrieved PPID as output.

Getting a Known PPID’s PIDs

Here, we use the ps command with the -O flag which makes it possible to print out the PID and PPID columns side by side.

In this article, we have differentiated PID, TID, and PPID identifiers and also shown various command-line approaches to retrieving their respective values. Hope you enjoyed the article and feel free to leave a comment or feedback.

Источник

Delightly Linux

⌚ June 25, 2012
If you have ever opened System Monitor or top you no doubt noticed a column named ID or PID containing a list of numbers. You might even see a value called PPID. What do these numbers mean?

Here is a short explanation of these Linux terms.

In Linux, an executable stored on disk is called a program, and a program loaded into memory and running is called a process. When a process is started, it is given a unique number called process ID (PID) that identifies that process to the system. If you ever need to kill a process, for example, you can refer to it by its PID. Since each PID is unique, there is no ambiguity or risk of accidentally killing the wrong process (unless you enter the wrong PID).

If you open top (in a terminal, type top and press enter), the PID column lists the process IDs of all processes currently loaded into memory regardless of state (sleeping, zombie, etc.). Both daemons (system processes) and user processes (processes you started either automatically or manually) have their own process IDs. The PIDs are not always assigned in numerical order, so it’s normal to see what appears to be a random selection of numbers.

init

One very important process is called init. init is the grandfather of all processes on the system because all other processes run under it. Every process can be traced back to init, and it always has a PID of 1. The kernel itself has a PID of 0.

What is the PPID?

In addition to a unique process ID, each process is assigned a parent process ID (PPID) that tells which process started it. The PPID is the PID of the process’s parent.

For example, if process1 with a PID of 101 starts a process named process2, then process2 will be given a unique PID, such as 3240, but it will be given the PPID of 101. It’s a parent-child relationship. A single parent process may spawn several child processes, each with a unique PID but all sharing the same PPID.

Why is the PPID Important?

Occasionally, processes go bad. You might try to quit a program only to find that it has other intentions. The process might continue to run or use up resources even though its interface closed. Sometimes, this leads to what is called a zombie process, a process that is still running, but dead.

One effective way to kill a zombie process is to kill its parent process. This involves using the ps command to discover the PPID of the zombie process and then sending a kill signal to the parent. Of course, any other children of the parent process will be killed as well.

pstree

pstree is a useful program that shows the relationship of all processes in a tree-like structure.

Give it a try to see how processes are arranged on your system. Processes do not float by themselves somewhere in memory. Each one has a reason for its existence, and a tree view helps show how it relates to others.

pstree supports options to adjust the output, so check man pstree for more details. Entering the following command lists the PID with each process and organizes processes by their ancestors (numerically) to show their relationship with each other.

htop

For simpler process management and a better way to see how processes are organized, have a look at the program htop, which displays PID, optional PPID, process tree view, and much more information in glorious color!

Htop showing processes arranged in tree view along with PID and PPID.

Источник