Showing your processes in a hierarchical list is very useful for confirming the relationship between every process running on your system. Today I’d like to show you how you can get tree-like processes lists using various commands.

Showing processes tree with ptree

In Solaris, there’s quite a few commands which make the life of any system administrator much easier, they’re the process commands (p-commands). One of them which I particularly like is the ptree command which shows you a list of processes.

As you run the command, you get a hierarchical list of all the processes running on your Solaris system, along with process IDs (PIDs). To me, this is a very useful command, because it shows you how exactly each process relates to others in your system.

Here’s a fragment of the ptree output:

bash-3.00$ ptree
7     /lib/svc/bin/svc.startd
  250   /usr/lib/saf/sac -t 300
    268   /usr/lib/saf/ttymon
  260   -sh
    5026  -csh
9     /lib/svc/bin/svc.configd
107   /usr/lib/sysevent/syseventd
136   /usr/lib/picl/picld
140   /usr/lib/crypto/kcfd
159   /usr/sbin/nscd
227   /usr/sbin/rpcbind
234   /usr/lib/nfs/statd
235   /usr/sbin/keyserv
236   /usr/lib/netsvc/yp/ypserv -d
  237   rpc.nisd_resolv -F -C 8 -p 1073741824 -t udp
241   /usr/lib/nfs/lockd
247   /usr/lib/netsvc/yp/ypbind
263   /usr/lib/utmpd
286   /usr/sadm/lib/smc/bin/smcboot
  287   /usr/sadm/lib/smc/bin/smcboot
  288   /usr/sadm/lib/smc/bin/smcboot

Processes tree with pstree

In most Linux distributions, you can find a pstree command, very similar to ptree.

That’s how you may use it (-p is an option to show PIDs and -l uses long output format):

ubuntu$ pstree -pl
init(1)─┬─NetworkManager(5427)
        ├─NetworkManagerD(5441)
        ├─acpid(5210)
        ├─apache2(6966)─┬─apache2(2890)
        │               ├─apache2(2893)
        │               ├─apache2(7163)
        │               ├─apache2(7165)
        │               ├─apache2(7166)
        │               ├─apache2(7167)
        │               └─apache2(7168)
        ├─atd(6369)
        ├─avahi-daemon(5658)───avahi-daemon(5659)
        ├─bonobo-activati(7816)───{bonobo-activati}(7817)
...

Showing processes tree with ps –forest

ps command found in Linux has a –forest option, which shows you a tree structure of processes.

The best in my experience is to use it like this:

ubuntu$ ps -aef --forest
UID        PID  PPID  C STIME TTY          TIME CMD
...
107       5473     1  0 10037  4600   0 Apr28 ?        00:00:02 /usr/sbin/hald
root      5538  5473  0  5511  1288   0 Apr28 ?        00:00:00  \_ hald-runner
root      5551  5538  0  6038  1284   0 Apr28 ?        00:00:01      \_ hald-addon-input: Listening on /dev/input
107       5566  5538  0  4167   992   1 Apr28 ?        00:00:00      \_ hald-addon-acpi: listening on acpid socke
root      5600  5538  0  6038  1272   1 Apr28 ?        00:00:15      \_ hald-addon-storage: polling /dev/scd0 (ev
root      5476     1  0 10272  2532   0 Apr28 ?        00:00:00 /usr/sbin/console-kit-daemon
root      5627     1  0 12728  1176   1 Apr28 ?        00:00:00 /usr/sbin/sshd
root      9151  5627  0 17536  3032   0 10:53 ?        00:00:00  \_ sshd: greys [priv]
greys     9162  9151  0 17538  1892   1 10:54 ?        00:00:00      \_ sshd: greys@pts/3
greys     9168  9162  0  5231  3820   1 10:54 pts/3    00:00:00          \_ -bash
greys     9584  9168  0  3802  1124   0 11:27 pts/3    00:00:00              \_ ps -aeF --forest

This output is for demonstration purpose only, and so I’ve taken the first lines of the output out because they weren’t serving the purpose of this example very well.

For thins fragment of the output you can see how you get all the vital information about each process. I really like this way of running the ps command.

That’s it for today! Do you know any other neat way of looking at processes tree? Let me know!

Another quick answer to the question I see a lot in search queries on this blog: listing directories in a directory. I take it that this question means showing a list of only the directories and not other files under a certain location of your Unix filesystem.

Using find to show only directories

find command helps you show only the directories by using a -type d parameter.

Compare the default find output of finding files and directories under /etc/mysql:

ubuntu# find /etc/mysql 
/etc/mysql
/etc/mysql/debian.cnf
/etc/mysql/conf.d
/etc/mysql/my.cnf
/etc/mysql/debian-start

To the one which only shows you the directories:

ubuntu# find /etc/mysql -type d
/etc/mysql
/etc/mysql/conf.d

And if you’re in doubt, you can always use ls -ld command to confirm that returned entries are really standard Unix directories:

ubuntu# ls -ld /etc/mysql /etc/mysql/conf.d
drwxr-xr-x 3 root root 4096 2008-03-28 07:56 /etc/mysql
drwxr-xr-x 2 root root 4096 2008-03-25 21:06 /etc/mysql/conf.d

That’s it! Have fun with Unix!

See also:

• How to Find a Location of a Directory in Unix
• Unix Commands: find
• How To Find the Largest Files in Your Unix

Very quick tip for you today, I just see that many of visitors of this block are curious how they can find a directory in Unix – and so here’s a command to help you do just that.

Finding directories in Unix

There’s nothing better than to employ the find command. As you might remember, among many things, this wonderful tool allows you to search files by their type. Since nearly everything in Unix is a file, this means you can find directories.

Let’s take an example: if you wand to find out everything about your MySQL installation, you can have a search across your filesystems to find all the directories called mysql:

Here is how you would find a directory called mysql under /etc directory:

ubuntu# find / -name mysql -type d
/var/log/mysql
/var/lib/mysql
/var/lib/mysql/mysql
/etc/mysql
/usr/lib/perl5/DBD/mysql
/usr/lib/perl5/auto/DBD/mysql
/usr/share/mysql

As you can see, there are quite a few directories which belong to MySQL, and you can see from the list that MySQL configuration is most likely to be in /etc/mysql directory.

Narrowing down directory search in Unix

If you search across all your filesystems, it may take too much time. That’s why it makes sense to narrow your search using common sense.

For example, if you’re looking for a configuration file of some standard package of software, most likely it will be under /etc directory, so you can specify it and greatly reduce the searching time.

In this example, we’re narrowing directory search to only those directories that are part of /etc:

ubuntu# find /etc -name mysql -type d
/etc/mysql

See also:

• Unix Commands: find
• How To Find the Largest Files in Your Unix
• Finding Large Files and Directories

The questions about default block sizes used in your Unix system are always popular. Today I’d like to show you a few ways to answer them.

Default block size in Linux

If you ever want to confirm the block size of any filesystem of Ubuntu or any other Linux OS, tune2fs command is here to help:

ubuntu# tune2fs -l /dev/sda1 | grep Block
Block count:              4980736
Block size:               4096
Blocks per group:         32768

From this example, you can see that the default block size for the filesystem on /dev/sda1 partition is 4096 bytes, or 4k. That’s the default block size for ext3 filesystem.

Default block size in Solaris

The default block size in Solaris is 8192 bytes, or 8k. However, some architectures allow you to use 4k size as well, by specifying it as a command line option for the newfs command.

To be absolutely sure, you can use one of the commands: df -g (takes a filesystem mount point name as the parameter – / or /usr for example) or use fstyp -v command (needs a character device of the filesystem you’re interested in).

Using df -g to confirm the filesystem block size

This command can be used as any user, so to confirm a block size for any of the filesystems you don’t have to be root. However, it works only for mounted filesystems.

bash-3.00$ df -g /
/                  (/dev/dsk/c1t0d0s0 ):         8192 block size          1024 frag size
12405898 total blocks    4399080 free blocks  4275022 available         751296 total files
603544 free files     30932992 filesys id
ufs fstype       0x00000004 flag             255 filename length

Using fstyp -v to confirm the filesystem block size

Because this command accesses the character device of a particular filesystem, you have to be root to run it. But as a bonus compared to df -g, you can use fstyp -v on an unmounted filesystem:

bash-3.00# fstyp -v /dev/dsk/c1t0d0s0 | grep ^bsize
bsize   8192    shift   13      mask    0xffffe000

Many software products, especially the commercial ones, are distributed as 32-bit packages. This means that they won’t be installed on your 64-bit system unless you clearly specify that you want to override the architecture dependency.

If you’re using Ubuntu or any other Debian based distribution, this post will teach you how to install 32-bit deb packages on your 64-bit OS.

Is it possible to run 32-bit applications on 64-bit OS?

In Unix world, yes: it is quite possible to run 32-bit binaries on 64-bit OS. There should generally be no problem, but there are, as always, a few caveats:

• your 64-bit system may need some 32-bit libraries installed just to make some old 32-bit software work (use getlibs in Ubuntu)
• even if 32-bit application runs on your 64-bit system, it will still have the 32-bit limitations
• some (especially commercial) software has hard-coded architecture checks which will prevent them from working in 64-bit mode. Although it’s a rather rare case, it still may happen and it probably means the developers had a really good reason for putting such limitations in

Why 32-bit packages don’t install on 64-bit by default

One of the main reasons is that if a certain software is provided in 32-bit configuration, it’s very likely to be available in 64-bit one as well. In Unix especially so, since a properly coded application can very easily be compiled for both architectures, especially if you have a 32-bit application and it’s only a matter of recompiling it in 64-bit.

It’s always best to have 64-bit version of the software, as it will run better and enjoy most optimal performance by running in the native mode and using 64-bit libraries of your OS.

The default behaviour is to let you know that you’re trying to install an architecturally incompatible piece of software, which should motivate you to double-check the availability of a 64-bit version. For example, this is what I get when installing a Skype for Linux on my Ubuntu 7.10 64-bit desktop:

ubuntu# dpkg -i ./skype-debian_2.0.0.63-1_i386.deb 
dpkg: error processing ./skype-debian_2.0.0.63-1_i386.deb (--install):
 package architecture (i386) does not match system (amd64)
Errors were encountered while processing:
 ./skype-debian_2.0.0.63-1_i386.deb

How To Install 32-bit Debian Packages on 64-bit System

Since I know there isn’t a 64-bit distribution of Skype, I would still like to install the package as it should work just fine. And the way to do this is to specify a –force-architecture option in dpkg command line:

ubuntu# dpkg -i --force-architecture ./skype-debian_2.0.0.63-1_i386.deb 
dpkg - warning, overriding problem because --force enabled:
 package architecture (i386) does not match system (amd64)
Selecting previously deselected package skype.
(Reading database ... 124455 files and directories currently installed.)
Unpacking skype (from .../skype-debian_2.0.0.63-1_i386.deb) ...
Setting up skype (2.0.0.63-1) ...

As you can see, we’re getting a warning, but the install went through just fine.

Warning: there’s a few further steps to get Skype working in 64-bit Ubuntu, so don’t take the above as a Skype how-to, these steps are out of the scope of this post though.

I see this question a lot in search engines requests which point to this blog. And if you’re so interested how this is done, I’m happy to explain.

Standard shell environment variables pointing to user id

Not only in bash, but in any other shell on your system, there’s quite a few standard environment variables set by default when you log in. Among them there are ones which contain your username, and so you can use them to find out the uid as well.

The variables I’m talking about are USER and USERNAME. Both of them should contain the same user name, in my example it’s greys:

ubuntu:~$ echo $USER
greys
ubuntu:~$ echo $USERNAME
greys

Knowing the username, it’s very easy to use the id command to confirm the user id:

greys@ubuntu:~$ id -u greys

1000

Bash environment variables

In Bash specifically, there’s also a few variables automatically set for your convenience so that you don’t have to figure UID based on the username.

In fact, there are three variables which you will find useful:

• UID – your user ID
• EUID – your effective user ID
• GROUPS – array of all the Unix groups you belong to

Here is how to show the values of these variables:

ubuntu$ echo $UID
1000
ubuntu$ echo $EUID
1000
ubuntu$ echo $GROUPS
113

To some this may seem like a trivial task, but I see great interest from Unix/Linux beginners arriving to this blog: how exactly does one confirm what a symlink points to?

First of all, if you haven’t already done so – read my Unix Symlink Example post to learn what a symlink is and to refresh your mind about creating symlinks.

If you’re still reading, perhaps a bit more explanations are needed.

Since symlink is nothing but a special Unix file, you can use all the standard Unix commands to work with it – list it or remove it for example.

Listing symlinks

For listing files, the most obvious choice is a Unix ls command, and the way you use it to list symlink is the same way you’d list any other file:

ubuntu$ ls ubuntu-release 
ubuntu-release

Now we come to exactly the reason why some people don’t find working with symlinks obvious: when we list the symlink, we expect to see the file it points to. More precisely, we expect to see the name of this file.

Showing what a symlink points to

To show what a symlink points to, you need to use a long format of the ls command:

ubuntu$ ls -l ubuntu-release 
lrwxrwxrwx 1 greys greys 10 2008-03-23 16:53 ubuntu-release -> /etc/issue

As you can see, the ubuntu-release symlink points to the /etc/issue file.

I see that my Finding Large Files and Directories post is quite popular, yet there are a few more ways to simplify your search for the largest disk space consumers in your Unix system.

Make find command show file sizes

If you remember, the default way a find command reports results includes only the fully qualified (that means including the full path) filenames.

Now, if you look at a task of identifying the largest files, it’s great if you can get a list of all the files bigger than some figure your specify, but what would be even better is to include the exact size of each file right into the output of the find command.

Here’s how you do it: it’s possible to specify which information about each file you’d like to see. Check out the find command man page for all the possibilities, but in today’s example I’m using two parameters: %s means the size of a file in bytes and %f means the filename itself.

Let’s say I want to get a list of all the files under /usr directory which are larger than 15Mb each, and show the exact size of each file. Here’s how it can be done:

ubuntu$ find /usr -size +15M -printf "%s - %p\n"
39859372 - /usr/lib/vmware/webAccess/java/jre1.5.0_07/lib/rt.jar
35487120 - /usr/lib/vmware/bin/vmware-hostd
16351166 - /usr/lib/vmware/bin/vmplayer
38353296 - /usr/lib/vmware/hostd/libtypes.so
54366585 - /usr/lib/vmware/hostd/docroot/client/VMware-viclient.exe
92143616 - /usr/lib/vmware/isoimages/linux.iso
23494656 - /usr/lib/vmware/isoimages/windows.iso
47070920 - /usr/lib/libgcj.so.81.0.0
20890468 - /usr/share/fonts/truetype/arphic/uming.ttf
17733780 - /usr/share/icons/crystalsvg/icon-theme.cache
18597793 - /usr/share/myspell/dicts/th_en_US_v2.dat
45345879 - /usr/src/linux-source-2.6.22.tar.bz2

Just to help you refresh your mind, here’s the explanation of all the parameters in the command line:

• /usr is the directory where we’d like to find the files of interest
• -size +15M narrows our interest to only the files larger than 15Mb
• -printf “%s – %p\n” is the magic which shows the nice list of files along with their sizes.

Sort the list of files by filesize

Next really useful thing we could do is to sort this list, just so that we could see a nice ordered representation of how big each file is. It’s very easily done by piping the output of the find command to a sort command:

ubuntu$ find /usr -size +15M -printf "%s - %p\n" | sort -n
16351166 - /usr/lib/vmware/bin/vmplayer
17733780 - /usr/share/icons/crystalsvg/icon-theme.cache
18597793 - /usr/share/myspell/dicts/th_en_US_v2.dat
20890468 - /usr/share/fonts/truetype/arphic/uming.ttf
23494656 - /usr/lib/vmware/isoimages/windows.iso
35487120 - /usr/lib/vmware/bin/vmware-hostd
38353296 - /usr/lib/vmware/hostd/libtypes.so
39859372 - /usr/lib/vmware/webAccess/java/jre1.5.0_07/lib/rt.jar
45345879 - /usr/src/linux-source-2.6.22.tar.bz2
47070920 - /usr/lib/libgcj.so.81.0.0
54366585 - /usr/lib/vmware/hostd/docroot/client/VMware-viclient.exe
92143616 - /usr/lib/vmware/isoimages/linux.iso

As you can see, the smallest files (just above 15Mb) are at the top of the list, and the largest ones are at the bottom.

Limit the number of files returned by find

The last trick I’ll show you today is going to make your task even easier: why look at the pages of find commnand output, if you’re after only the largest files? After all, your list can be much longer than the one shown above. To solve this little problem we’ll pipe the output of all the commands to yet another unix command, tail.

tail command allows you to show only a specified number of lines of any standard input or Unix text file you point it to. By default, it strips the number of lines to 10, which can be enough for your purposes.

Here’s how you can get a least of the 10 largest files under /usr:

ubuntu$ find /usr -size +15M -printf "%s - %p\n" | sort -n | tail
18597793 - /usr/share/myspell/dicts/th_en_US_v2.dat
20890468 - /usr/share/fonts/truetype/arphic/uming.ttf
23494656 - /usr/lib/vmware/isoimages/windows.iso
35487120 - /usr/lib/vmware/bin/vmware-hostd
38353296 - /usr/lib/vmware/hostd/libtypes.so
39859372 - /usr/lib/vmware/webAccess/java/jre1.5.0_07/lib/rt.jar
45345879 - /usr/src/linux-source-2.6.22.tar.bz2
47070920 - /usr/lib/libgcj.so.81.0.0
54366585 - /usr/lib/vmware/hostd/docroot/client/VMware-viclient.exe
92143616 - /usr/lib/vmware/isoimages/linux.iso

Show the largest 10 files in your Unix system

Now that you know all the most useful tricks, you can easily identify and show the list of the 10 largest files in your whole system. Bear in mind, that you should probably run this command with root privileges, as files in your system belong to various users, and a single standard user account will most likely have insufficient privileges to even list such files.

If you’re trying to locate your largest files in Ubuntu, use the sudo command (assuming you have the sudo privileges to become root):

ubuntu$ sudo find / -size +15M -printf "%s - %p\n" | sort -n | tail

alternatively, just become root by doing something like this (you obviously should know the root password to do that):

$ su - root 

and then run the find command itself. Here’s how the output looks on my Ubuntu desktop:

ubuntu$ find / -size +15M -printf "%s - %p\n" | sort -n | tail
39859372 - /usr/lib/vmware/webAccess/java/jre1.5.0_07/lib/rt.jar
45345879 - /usr/src/linux-source-2.6.22.tar.bz2
45356784 - /var/cache/apt/archives/linux-source-2.6.22_2.6.22-14.52_all.deb
45424028 - /var/cache/apt/archives/kde-icons-oxygen_4%3a4.0.2-0ubuntu1~gutsy1~ppa1_all.deb
47070920 - /usr/lib/libgcj.so.81.0.0
54366585 - /export/dist/vmware/server2b2/vmware-server-distrib/lib/hostd/docroot/client/VMware-viclient.exe
54366585 - /usr/lib/vmware/hostd/docroot/client/VMware-viclient.exe
92143616 - /export/dist/vmware/server2b2/vmware-server-distrib/lib/isoimages/linux.iso
92143616 - /usr/lib/vmware/isoimages/linux.iso
340199772 - /export/dist/vmware/server2b2/VMware-server-e.x.p-63231.x86_64.tar.gz

That’s it for today, hope this helps! Please bookmark this post if you liked it, and leave comments if there are any questions!

Surprisingly, I see quite a few questions around file ownership asked all the time. And one of the first questions asked concerns the Unix user who owns a particular file.

It’s very easy to confirm who the owner of a file is, and you can do it using the ls command.

Find the owner of a file

Using -l command line option, you make ls return the output in a long format. And two fields in each line of the output are showing you the username and the group name which file belongs to.

In this example, we can see that /etc/passwd belongs to a user root and a unix group called root:

ubuntu$ ls -l /etc/passwd
-rw-r--r-- 1 root root 1443 Jan 30 16:49 /etc/passwd

And if I look at one of my own files, you can see that it belongs to me (greys) and to my primary unix group (admin):

ubuntu$ ls -l /home/greys/myfile.txt
-rw-r--r-- 1 greys admin 0 Mar 20 05:13 /home/greys/myfile.txt

That’s it, do you see yourself that it’s not rocket science? Do ask questions in the comments if you’re still not sure about details!

When you’re trying to clean up your filesystems and reclaim some space, one of the first things you’ll want to do is to confirm the largest directories and individual files you have. This can be easily done using two Unix commands: find command and du command.

Find files larger than a certain size

It’s very simply to find files which are larger than a specified size. The find command accepts a size parameter, and you can specify the limits for file sizes in your command line.

This example finds all the files under /etc directory which are larger than 100k:

root@ubuntu# find /etc -size +100k
/etc/ssh/moduli
/etc/ssl/certs/ca-certificates.cr
/etc/bash_completio

If we look at their sizes, they really are above 100k:

root@ubuntu# ls -l /etc/ssh/moduli /etc/ssl/certs/ca-certificates.crt /etc/bash_completio
-rw-r--r-- 1 root root 215938 Apr 10  2007 /etc/bash_completion
-rw-r--r-- 1 root root 132777 Feb 19  2007 /etc/ssh/moduli
-rw-r--r-- 1 root root 149568 Sep  7  2007 /etc/ssl/certs/ca-certificates.crt

Find files within specified size limits

The real beauty of using find command is that you can specify both the lower and the upper file size limit in one command line. Working off the previous example, we can limit the search to find only files with the size of 100k-150k, quite easily:

root@ubuntu# find /etc -size +100k -size -150k
/etc/ssl/certs/ca-certificates.crt
/etc/bash_completion

As you can see from the syntax, the size specification can contain a sign – plus or minus indicates whether you’re looking for a file with the size above or under a given figure.

Show directory sizes using du

du command takes a little while to run, depending on what directory you pass it as a parameter, but then prints you a list of all the subdirectories along with their sizes. Most common usage is shown below, -s parameter makes the command report a summary of disk usage stats for only the specified directories matching the /usr/* mask (and not their subdirectories), and -k specifies that we want to see the results in kilobytes:

root@ubuntu# du -sk /usr/*
90824   /usr/bin
4       /usr/games
23644   /usr/include
404196  /usr/lib
0       /usr/lib64
116     /usr/local
22020   /usr/sbin
309516  /usr/share
301600  /usr/src

In most Linux systems, this command had been updated to support a -h parameter, which makes sizes even easier to interpret:

root@ubuntu# du -sh /usr/*
89M     /usr/bin
4.0K    /usr/games
24M     /usr/include
395M    /usr/lib
0       /usr/lib64
116K    /usr/local
22M     /usr/sbin
303M    /usr/share
295M    /usr/src

Sorting directory sizes

Now, the previous example would get a lot more useful if you sort the directories by their size. The only problem is that sort -n (numerical sorting) would sort by numbers but ignore the human-readable element (M for megabytes, K for kilobytes, G for gigabytes) thus giving you a complete mess:

root@ubuntu# du -sh /usr/* | sort -n
0       /usr/lib
644.0K    /usr/games
22M     /usr/sbin
24M     /usr/include
89M     /usr/bin
116K    /usr/local
295M    /usr/src
303M    /usr/share
395M    /usr/lib

So what do we to? Luckily for us, Linux implementation of sort supports -h option which does exactly the kind of sorting we needed:

root@ubuntu# du -sh /usr/* | sort -h
0       /usr/lib
644.0K    /usr/games
116K    /usr/local
22M     /usr/sbin
24M     /usr/include
89M     /usr/bin
295M    /usr/src
303M    /usr/share
395M    /usr/lib

See Also

• Basic unix commands