I'm able to find processes using top or ps. That's no problem.

Sometimes I find that some processes are taking up a lot of memory or cpu and I'm trying to identify what the root program is.

For instance, the process sort sometimes just ends up taking 2-3 gigs of memory over like 4 hours. I'd like to know what program initiated the sort process so I can try and fix it.


ps has an option to access the PPID/parent PID of a process:

$ ps aux -o ppid
USER               PID  %CPU %MEM      VSZ    RSS   TT  STAT STARTED      TIME COMMAND           PPID
admin            65694  10.9  0.1  4385132  13340   ??  UN    9:32PM   0:00.07 /System/Library/     1

PPID is the last column in this case.

(Or use Activity Monitor by selecting View -> All Processes, Hierarchically)

| improve this answer | |
  • Are you sure this is a right command? I have an error: $ ps -aux -o PPID ps: No user named 'x' ps: PPID: keyword not found ps: no valid keywords; valid keywords: – Mateusz Szlosek Oct 13 '17 at 14:32
  • I‘m not close to a Mac righting, might have gotten that wrong – nohillside Oct 13 '17 at 14:42
  • @user3439894 It works now:) But the problem is, that I don't see the process name in COMMAND tab, just the start of the path (16 chars) – Mateusz Szlosek Oct 13 '17 at 14:51
  • 2
    @Mateusz Szlosek, Try using ps auxc -o ppid instead, you will at least get the executable name of the process to show right before the ppid. Also read the manual page for ps. – user3439894 Oct 13 '17 at 15:10

You can use htop and show "tree" precesses (by pressing F5) there. Here's an example:

htop example screen

| improve this answer | |
  • I ended up using htop for my needs (before seeing this answer) and it worked great. Thanks! I chose the other Answer because it was what I was originally looking for and it didn't require extra binaries to perform. – jwmann Oct 18 '17 at 1:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .