Find a Process's Parent with ps ppid

Show a process alongside its parent PID so you know what launched it.

macOSProcessesTerminaltroubleshootingLow risk

Run ps -o pid,ppid,command -p 1234 to print the process, its parent PID, and the full command in three columns.

01Command

Command

$ ps -o pid,ppid,command -p <PID>

02What it does

Every macOS process is started by another process, and the ppid column records that parent. Selecting the pid, ppid and command columns with -o and limiting output to one PID with -p gives a compact answer. Take the ppid from the result and feed it back into the same command to walk up the chain until you reach launchd (PID 1), the ancestor of everything.

03Risk

RiskLow risk

!Warning: A ppid of 1 usually means the original parent has already exited and launchd adopted the process, which is normal for background jobs.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

PS(1) — macOS man page
KEITH · technical · 2026-09-17
Evidence: The man page lists ppid as a standard output keyword ("uid, pid, ppid, flags, ...") and documents the -o option to select exactly which columns are displayed.
ps(1) man page
manpagez.com · technical · 2026-09-17
Evidence: The page documents the -o format option for specifying output columns including ppid, and the -p option to select processes by process ID.

Last verified: 2026-09-19 · Category: System & Settings