I'm able to find processes using top or ps. That's no problem.

Sometimes I find that some processes are taking up a lot of memory or cpu and I'm trying to identify what the root program is.

For instance, the process sort sometimes just ends up taking 2-3 gigs of memory over like 4 hours. I'd like to know what program initiated the sort process so I can try and fix it.

3 Answers 3


ps has an option to access the PPID/parent PID of a process:

$ ps aux -o ppid
USER               PID  %CPU %MEM      VSZ    RSS   TT  STAT STARTED      TIME COMMAND           PPID
admin            65694  10.9  0.1  4385132  13340   ??  UN    9:32PM   0:00.07 /System/Library/     1

PPID is the last column in this case.

(Or use Activity Monitor by selecting View -> All Processes, Hierarchically)

  • Are you sure this is a right command? I have an error: $ ps -aux -o PPID ps: No user named 'x' ps: PPID: keyword not found ps: no valid keywords; valid keywords: Oct 13, 2017 at 14:32
  • I‘m not close to a Mac righting, might have gotten that wrong
    – nohillside
    Oct 13, 2017 at 14:42
  • @user3439894 It works now:) But the problem is, that I don't see the process name in COMMAND tab, just the start of the path (16 chars) Oct 13, 2017 at 14:51
  • 2
    @Mateusz Szlosek, Try using ps auxc -o ppid instead, you will at least get the executable name of the process to show right before the ppid. Also read the manual page for ps. Oct 13, 2017 at 15:10
  • ps -ef will show PID and PPID in the second and third columns.
    – WGroleau
    Mar 31, 2021 at 18:05

You can use htop and show "tree" precesses (by pressing F5) there. Here's an example:

htop example screen

  • I ended up using htop for my needs (before seeing this answer) and it worked great. Thanks! I chose the other Answer because it was what I was originally looking for and it didn't require extra binaries to perform.
    – jwmann
    Oct 18, 2017 at 1:38

MacOS users, in accordance to @nohillside answer, please use:

ps auxo ppid

This will simply add the ppid column to the default "u" columns.

flags explanation:

  • a (other users process)
  • u (columns: user, pid, %cpu, %mem, vsz, rss, tt, state, start, time, and command)
  • x (also non terminal processes)
  • o (specify keywords for extra columns)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .