A process does not start by itself. Another process starts it. That process is its parent, and the new process is its child.
When you run a command, your shell starts it. So the shell is the parent of each command that you run.
ps -ef: see the parent
The flag -f shows more columns. Put it together with -e:
text
learner@tidepool:~$ ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 Oct09 ? 00:00:03 /sbin/init
root 530 1 0 Oct09 ? 00:00:00 /usr/sbin/sshd -D
root 1180 530 0 09:10 ? 00:00:00 sshd: learner [priv]
learner 1187 1180 0 09:10 ? 00:00:00 sshd: learner@pts/0
learner 1201 1187 0 09:10 pts/0 00:00:00 -bash
learner 1311 1201 0 09:14 pts/0 00:00:00 ps -ef| Column | Means |
|---|---|
UID | The account that runs the process |
PID | The process ID |
PPID | The parent process ID |
STIME | When it started |
CMD | The full command line |
Follow the parents
Start at ps and follow the PPID column up:
/sbin/initPID 1: the first process
sshdPID 530: accepts connections to this computer
sshd: learner@pts/0PID 1187: your connection
bashPID 1201: your shell
ps -efPID 1311: the command that you ran
PID 1
When the computer starts, the kernel starts one process: PID 1. On this computer, it is /sbin/init, also called systemd. PID 1 starts the programs that run in the background, such as sshd and cron. Its parent is 0, the kernel itself.
If a parent ends before its child, PID 1 becomes the new parent of the child.