Elegantly get list of descendant processes

Question

I would like to get a list of all the processes that descend (e.g. children, grand-children, etc) from $pid. This is the simplest way I've come up with:

pstree -p $pid | tr "\n" " " |sed "s/[^0-9]/ /g" |sed "s/\s\s*/ /g"

Is there any command, or any simpler way to get the full list of all descendant processes?

Answer 1

The following is somewhat simpler, and has the added advantage of ignoring numbers in the command names:

pstree -p $pid | grep -o '([0-9]\+)' | grep -o '[0-9]\+'

Or with Perl:

pstree -p $pid | perl -ne 'print "$1\n" while /\((\d+)\)/g'

We're looking for numbers within parentheses so that we don't, for example, give 2 as a child process when we run across gif2png(3012). But if the command name contains a parenthesized number, all bets are off. There's only so far text processing can take you.

So I also think that process groups are the way to go. If you'd like to have a process run in its own process group, you can use the 'pgrphack' tool from the Debian package 'daemontools':

pgrphack my_command args

Or you could again turn to Perl:

perl -e 'setpgid or die; exec { $ARGV[0] } @ARGV;' my_command args

The only caveat here is that process groups do not nest, so if some process is creating its own process groups, its subprocesses will no longer be in the group that you created.

Answer 2

descendent_pids() {
    pids=$(pgrep -P $1)
    echo $pids
    for pid in $pids; do
        descendent_pids $pid
    done
}

Answer 3

There is also the issue of correctness. Naively parsing the output of pstree is problematic for several reasons:

• pstree displays PIDs and the ids of threads (names are shown in curly braces)
• a command name might contain curly braces, numbers in parentheses that make reliable parsing impossible

If you have Python and the psutil package installed you can use this snippet to list all descendant processes:

pid=2235; python3 -c "import psutil
for c in psutil.Process($pid).children(True):
  print(c.pid)"

(The psutil package is e.g. installed as a dependency of the tracer command which is available on Fedora/CentOS.)

Alternatively, you can do an breadth-first traversal of the process tree in a bourne shell:

ps=2235; while [ "$ps" ]; do echo $ps; ps=$(echo $ps | xargs -n1 pgrep -P); \
  done | tail -n +2 | tr " " "\n"

For computing the transitive-closure of a pid, the tail part can be omitted.

Note that the above doesn't use recursion and also runs in ksh-88.

On Linux, one can eliminate the pgrep call and instead read the information from /proc:

ps=2235; while [ "$ps" ]; do echo $ps ; \
  ps=$(for p in $ps; do cat /proc/$p/task/$p/children; done); done \
  | tr " " "\n"' | tail -n +2

This is more efficient because we save one fork/exec for each PID and pgrep does some additional work in each call.

Answer 4

This Linux version needs /proc and ps only. It's adapted from the last piece of @maxschlepzig's excellent answer. This version reads /proc directly from the shell instead of spawning a sub-process in a loop. It's a bit faster and arguably slightly more elegant, as this thread title requests.

#!/bin/dash

# Print all descendant pids of process pid $1
# adapted from https://unix.stackexchange.com/a/339071

ps=${1:-1}
while [ "$ps" ]; do
  echo $ps
  unset ps1 ps2
  for p in $ps; do
    read ps2 < /proc/$p/task/$p/children 2>/dev/null
    ps1="$ps1 $ps2"
  done
  ps=$ps1
done | tr " " "\n" | tail -n +2

Answer 5

In each of your two (seemingly very artificial) use cases, why do you want to kill some unfortunate process's sub-processes? How do you know better than a process when its children should live or die? This seems like poor design to me; a process should clean up after itself.

If you really do know better, then you should be forking these sub-processes, and the 'daemonized process' is apparently too dumb to be trusted to fork(2).

You should avoid keeping lists of child processes or grovelling through the process tree, eg by putting the child processes in a separate process group as suggested by @Gilles.

In any case, I suspect that your daemonized process would be better off creating a worker thread pool (which necessarily dies along with its containing process) than a deep tree of sub-sub-sub-processes, which something somewhere then has to clean up.

Answer 6

The shortest version I have found that also deals correctly with commands like pop3d:

pstree -p $pid | perl -ne 's/\((\d+)\)/print " $1"/ge'

It deals wrongly if you have commands that have weird names like: my(23)prog.

Answer 7

Here's a pgrep wrapper script which lets you use pgrep and get all descendants at the same time.

~/bin/pgrep_wrapper:

#!/bin/bash

# the delimiter argument must be the first arg, otherwise it is ignored
delim=$'\n'
if [ "$1" == "-d" ]; then
    delim=$2
    shift 2
fi

pids=
newpids=$(pgrep "$@")
status=$?
if [ $status -ne 0 ]; then
    exit $status
fi

while [ "$pids" != "$newpids" ]; do
    pids=$newpids
    newpids=$( { echo "$pids"; pgrep -P "$(echo -n "$pids" | tr -cs '[:digit:]' ',')"; } | sort -u )
done
if [ "$delim" != $'\n' ]; then
    first=1
    for pid in $pids; do
        if [ $first -ne 1 ]; then
            echo -n "$delim"
        else
            first=0
        fi  
        echo -n "$pid"
    done
else
    echo "$pids"
fi

Invoke the same way you'd invoke normal pgrep, such as pgrep_recursive -U $USER java to find all Java processes and sub-processes from the current user.

Answer 8

I built a (Linux/procfs) tool called Procpath to query the process tree using JSONPath.

To get all descendant process' comma-separated PIDs of a non-root process (i.e. for PID=1 use simpler query ..stat.pid) it's:

$ procpath query -d, "..children[?(@.stat.pid == 15849)]..pid"
15849,16000,16039,16072,16109,16199

Answer 9

Yet another non-elegent script, using loop instead of recursion.

It only uses ps to recursively list all descendant process IDs.

It calls ps --ppid $PID -o pid= to output direct children PIDs of specified $PID, the format specifier -o pid= causes the output to be PIDs only.

#!/bin/sh
if [ -z "$1" ]; then
    echo USAGE: $0 PID
    exit 0
fi
get_children() {
    ps --ppid $1 -o pid=
}
children="$1"
output=""
while [ -n "$children" ]; do
    new_children=
    for id in $children; do
        result=$(get_children $id)
        if [ -n "$result" ]; then
            output="${output:+${output} }$result"
            new_children="${new_children:+${new_children} }$result"
        fi
    done
    children="$new_children"
done
#printf "%s\n" $output
echo $output

Answer 10

The following ksh88 code will return a list of the PIDs of all descendents of a particular PID. The ps invocation is for HP-UX 11.00, but something similar should work for any UNIX/Linux whose ps command can provide the PID and PPID fields.

It is divided into a non-recursive and recursive part, which allows ps to be run only once.

#-----------------------------------------------------------------------
# find_children_r()
# -----------------
# This is the recursive part which repeatedly finds all children for a
# particular set of PIDs and then calls itself to find the children of
# the children...
#-----------------------------------------------------------------------
export UNIX95=1 # needed for the "-o" flag to "ps"
function find_children_r {
    typeset parents="$1" ps_out="$2" found res tmp pid ppid args p
print -- "$ps_out"| while read pid ppid args; do
    # skip the header line
    [[ $pid = "PID" ]] && continue

    # skip ps command
    [[ $args = ps*pid,ppid,args ]] && continue

    for p in $parents; do
        if (( ppid == p )) ; then
            found="${found:+${found} }$pid"
        fi
    done
done

if [[ -z "$found" ]]; then return 1; fi

if tmp="$(find_children_r "$found" "$ps_out")"; then
    print -- "${found} $tmp"
else
    print -- "${found}"
fi

return 0

}
#-----------------------------------------------------------------------
find_children()
---------------
The non-recursive part that runs "ps" once and then passes the output
to the recursive part
#-----------------------------------------------------------------------
function find_children {
    typeset top_pid="$1" ps_out res
ps_out="$(ps -efo pid,ppid,args)"
res="$(find_children_r "$top_pid" "$ps_out")"

print -- "$res"

}

Answer 11

ps auxf will show you a full view of the process tree.