Spot processes adopted by PID 1 and reclaim control of stray jobs quickly. 16.11.2025 | reading time: 2 min A background job keeps chewing CPU or a daemon behaves oddly: is it orphaned and adopted by init or systemd? Use process listing to find children whose parent is PID 1 and act on the runaway job right away; this lesson shows commands and a short practical example. Create and spot an orphan Reproduce the situation and then identify it: start a short background sleep from a one-shot shell and then list processes whose PPID is 1. ```bash sh -c 'sleep 300 &' # now list processes with parent 1 ps -eo pid,ppid,cmd | awk '$2==1 {print}' # sample output (PID numbers vary): # 12345 1 sleep 300 ``` Variants and gotchas Not every process with PPID 1 is a problem, and PPID 1 on modern systems usually means systemd adopted the child; also: orphans are not zombies — an orphan runs normally whereas a zombie shows as <defunct> and occupies an exit slot. To filter safely, combine checks such as `ps -eo pid,ppid,state,cmd | awk '$2==1 && $3!~/Z/ {print}'` and avoid killing PID 1 or system processes. Commands you will use Useful, hands-on commands: `ps -eo pid,ppid,cmd` to inspect PPID, `ps --ppid 1 -o pid,cmd` or `pgrep -P 1` to list children of PID 1, and `pstree -p 1` to view the adoption tree; when you find a stray process, investigate its command and logs before sending SIGTERM or SIGKILL. Wrap-up and next steps Finding orphaned processes is mostly about checking PPID and understanding process trees; once he locates an orphan, he diagnoses why the parent died and either reaps, restarts or removes the job. Keep practicing with real systems and consider formal study to deepen your skills: pursue CompTIA Linux+ or LPIC-1 preparation, for focused exam training try bitsandbytes.academy. Join Bits & Bytes Academy First class LINUX exam preparation. processes troubleshooting utilities boot-process
