‘crash’ is useful tool to analyse system crashes or debugging in Linux system. It has many useful commands, but sometimes I wanted to get full picture of process list that was running at the time of crash. You can get process list with ‘ps’, but if you want to get hierarchical view, only ‘ps -p’ is the one that has similar feature, but shows parent processes just like in the below.
crash> ps -p 27597 PID: 0 TASK: ffffffff818d5440 CPU: 0 COMMAND: "swapper/0" PID: 1 TASK: ffff88007c080000 CPU: 0 COMMAND: "systemd" PID: 4099 TASK: ffff88005aaae660 CPU: 1 COMMAND: "gnome-terminal" PID: 4104 TASK: ffff88005aae2d80 CPU: 0 COMMAND: "bash" PID: 27590 TASK: ffff88005a9eb8e0 CPU: 1 COMMAND: "su" PID: 27597 TASK: ffff880076c638e0 CPU: 0 COMMAND: "bash"
It’s useful when you know which process you are concerning, but it wouldn’t be easy when you don’t know which one you are actually looking at. So, here comes ‘pstree’ which you can find the source code from the below.
To use it, you need to import it with the below command.
crash> extend ./pstree.so ./pstree.so: shared object loaded crash> man pstree NAME pstree - print process list in tree SYNOPSIS pstree [-p][-g] [pid] ... DESCRIPTION This command prints process list in tree The list can be modified by the following options -p print process ID -g print thread group instead of each threads EXAMPLE Print out process list crash> pstree init --+-- swapd +-- httpd +-... crash> pstree -p 4099 # of processes : 523 gnome-terminal-  -+- gnome-pty-helpe  `- bash  -+- su  -+- bash