Note that the PPID of all my commands is 3662, which is the pid of ksh. Everything I do runs under ksh.

---

Note:  
You might be wondering why TIME changed for third_one. Between the time I entered the ps and the ps -f commands, third_one used some CPU time—two seconds. On larger UNIX servers, a lot of work can be done with very little CPU time. That’s why the ps command itself is showing with zero CPU time; it used time, but not enough to round up to one second.

---

Two more common options are -e (e for every) and -u (u for user). The -e option is handy if you want to see whether the database is running or who is playing Zork (an old text-based computer game). Because so many processes run on a busy system, it is common to pipe the output of ps -e to a text filter like grep (see Chapter 15, “Text Filters”). The -u option is handy if you want to see what a specific user is doing—are they busy or do they have time to chat; is your boss busy or checking to make sure you’re not playing Zork?. With -u, you specify the user you want to list after the -u.

You can combine the -f option with -e or -u, but you cannot combine -e with -u.

Table 6.2 shows more BSD ps command options.

Use the man ps command for an explanation of all the available options. If you are ever in doubt about a command or option, use the man command to obtain information about that command. For the ps command, man ps gets you the manual page.

Killing a Process (kill Command)

Another handy command to use with jobs and processes is the kill command. As the name implies, the kill command kills, or ends, a process.

Just like the fg and bg commands, the job number is prefixed with a percent sign. To kill job number 1 in the earlier example regarding waiting for keyboard input, I use the following:

$ kill %1
[1] - Terminated               third_one &
$

You can also kill a specific process by specifying the process ID on the command line without the percent sign used with job numbers. To kill job number 2 (process 6738) in the earlier example using process ID, I use the following:

$ kill 6739
$

In reality, kill does not physically kill a process; it sends the process a signal. By default, it sends the TERM (value 15) signal. A process can choose to ignore the TERM signal or use it to begin an orderly shut down (flushing buffers, closing files, and so on). If a process ignores a regular kill command, you can use kill -9 or kill -KILL followed by the process ID or job number (prefixed with a percent sign). This forces the process to end.

---

Caution:  
Be very careful when specifying which process to kill, especially if you are using kill -9, because you can end a job by accident or even log yourself off. My command interpreter has the process ID of 3662, and I can try to kill it as follows:

$ ps -f
     UID   PID  PPID  C    STIME TTY      TIME CMD
 billing  3662  3657  0 08:10:53 pts/6    0:01 -ksh
$ kill 3662
$ ps -f
     UID   PID  PPID  C    STIME TTY      TIME CMD
 billing  3662  3657  0 08:10:53 pts/6    0:01 -ksh

ksh ignores a regular kill but not a kill -9, as follows:

$ kill -9 3662.

There is no command prompt after this command. I was disconnected from the system.

If your UNIX version does not support ps -f, you can use ps -ux.

---

Parent and Child Processes

In the ps -f example in the ps command section, each process has two ID numbers assigned to it: process ID (pid) and parent process ID (ppid). Each user process in the system has a parent process. Most commands that you run have the shell as their parent. The parent of your shell is usually the operating system or the terminal communications process (in.telnetd for telnet connections).

I have recreated this earlier example to demonstrate the ppid of all my commands is 3662, the pid of ksh, as follows:

$ ps -f
     UID   PID  PPID  C    STIME TTY      TIME CMD
 dhorvath 6738  3662  0 10:23:03 pts/6    0:00 first_one
 dhorvath 6739  3662  0 10:22:54 pts/6    0:00 second_one
 dhorvath 3662  3657  0 08:10:53 pts/6    0:00 -ksh
 dhorvath 6892  3662  4 10:51:50 pts/6    0:00 ps -f
 dhorvath 6770  3662  2 10:35:45 pts/6    0:03 third_one

The ppid of ksh is 3657. Using ps -ef (or ps -aux on some systems) and grep to find that number, I see the following:

$ ps -ef | grep 3657
 dhorvath 9778  3662  4 10:52:50 pts/6    0:00 ps -f
 dhorvath 9779  3662  0 10:52:51 pts/6    0:00 grep 3657
     root 3657   711  0 08:10:53 ?        0:00 in.telnetd
 dhorvath 3657  3662  0 08:10:53 pts/6    0:00 -ksh

This tells me that my terminal session is being handled by in.telnetd (the telnet daemon) that owns, or is the parent of, my Korn shell command interpreter.

There is a parent-child relationship between processes. in.telnetd is the parent of ksh, which is the child of in.telnetd but the parent of ps and grep.

When a child is forked, or created, from its parent, it receives a copy of the parent’s environment, including environment variables. The child can change its own environment, but those changes do not reflect in the parent and go away when the child exits.