Overview
Each process is identified by a PID (process ID). PIDs are how you (and the system) refer to a specific process to inspect, signal, or manage it. This lesson explains PIDs and the special role of PID 1.
Learning objectives
- Define the PID and how it is assigned.
- Explain the significance of PID 1.
- Use the PID to act on a specific process.
Core concept
A PID is a unique number the kernel assigns to each process when it starts. PIDs identify processes for all management operations — viewing, signaling, or terminating them. A few points:
- PID 1 is the init system (e.g.
systemd), the first process started at boot and the ancestor of all others. - PIDs are unique among currently running processes but are reused after a process exits.
- Related identifiers include the PPID (parent process ID) and, for grouping, the process group and session IDs.
How it works
When a process is created, the kernel assigns it the next available PID. You use that PID to target the process — for example, to send it a signal (covered next) or to look up its details. PID 1 is special: as the ancestor of every other process, it is responsible for starting system services and for "adopting" orphaned processes. Because PIDs are reused after exit, you should act on a PID promptly and be sure it still refers to the process you intend.
Practical example
$ pgrep nginx
812
$ ps -p 812 -o pid,ppid,user,cmd
PID PPID USER CMD
812 1 www-data nginx: worker process
pgrep nginx finds the PID (812), and ps -p 812 shows its details, including that its parent (PPID) is 1 — the init system. With PID 812 you can now inspect or signal exactly that process.
Cybersecurity relevance
PIDs are how you pin down and act on a specific process during investigation or response — for instance, identifying the PID of a suspicious process before examining or stopping it. Tracing the PPID chain up toward PID 1 helps reveal how a process was launched (its lineage), which can expose how malware started or persisted. Because a suspicious process may spawn or respawn, understanding PIDs and lineage is important for accurate response.
Common mistakes
- Assuming a PID is permanent — PIDs are reused after a process exits, so verify before acting.
- Overlooking PID 1's special role as the init system and ancestor of all processes.
- Ignoring the PPID, which reveals how and by what a process was started.
Key takeaways
- A PID is a unique number the kernel assigns to each running process, used to inspect or manage it.
- PID 1 is the init system (e.g. systemd) — the first process at boot and ancestor of all others; PIDs are reused after a process exits.
- PIDs (and PPIDs) let you target a specific process and trace its lineage — important for investigation and incident response.
Check your understanding
- What process has PID 1, and why is it special?
- Why should you not assume a given PID always refers to the same process over time?