{ Abhilash Kumar Bhattaram : Follow on LinkedIn }
A primer about what is ps
A ps (Process Status) Session involves analyzing active processes running on a Linux system using the ps command. This helps in understanding process hierarchies, resource usage, and user sessions.
By running ps -ef --forest, administrators can visualize the parent-child relationships between processes, making it easier to track user activity, troubleshoot performance issues, and identify orphan or rogue processes. This is especially useful when monitoring database sessions, such as tracing how a user (e.g., jumpusr) switches to another user (oracle), launches sqlplus, and initiates database operations.
ps sessions are essential for system performance monitoring, debugging, and ensuring smooth application execution.
Some common Oracle DBA examples
Some regularly used ones we use in our day to day life is every process is associated with a PID
-- To Check Database and listener
$ pf -ef|grep pmon
[oracle@machine1 ~]$ ps -ef|grep pmon
oracle 73840 1 0 20:23 ? 00:00:00 ora_pmon_cdbl
oracle 74265 73801 0 20:23 pts/0 00:00:00 grep --color=auto pmon
[oracle@machine1 ~]$
Now comes the part where you would like to go deeper into all the threads of a session.
Deep Dive into a ps session
Running ps -ef --forest on a Linux system provides a hierarchical (tree-like) view of all running processes. This helps in visualizing process relationships, such as parent-child structures, making it easier to trace how different sessions are spawned and interact.
Since you’re now able to navigate through each session, you can:
• Identify parent processes and their child processes.
• Track how user sessions and services are structured.
• Analyze dependencies between running processes.
If you’re troubleshooting a specific session, you can cross-check Process IDs (PIDs) with logs or use strace or lsof to get deeper insights. Let me know if you need help analyzing a specific process or understanding session behavior further!
That’s a great way to visualize session hierarchy! When you run ps -ef --forest, you’ll see something like this:
Breakdown:
1. jumpusr logs into the system and starts a Bash session.
2. jumpusr switches to oracle using su - oracle, creating a new session.
3. oracle starts another Bash shell.
4. oracle runs sqlplus / as sysdba, which then spawns Oracle database processes.
This tree view helps in identifying:
• Which user initiated a process.
• The parent-child relationship of processes.
• Any orphan or unexpected processes that may be running.
You see the tree view you can literally feel your session here as if you are looking into a mirror.
# ps -ef --forest
UID PID PPID C STIME TTY TIME CMD
.
<< excluding many PID's >>
.
jumpusr 120758 120754 0 13:58 ? 00:00:02 | \_ sshd: jumpusr@pts/8
jumpusr 120769 120758 0 13:58 pts/8 00:00:00 | \_ -bash
root 126118 120769 0 13:59 pts/8 00:00:00 | \_ sudo su - oracle
root 126119 126118 0 13:59 pts/8 00:00:00 | \_ su - oracle
oracle 126121 126119 0 13:59 pts/8 00:00:00 | \_ -bash
oracle 127518 126121 0 13:59 pts/8 00:00:00 | \_ sqlplus as sysdba
oracle 127519 127518 0 13:59 ? 00:00:00 | \_ oracleorcltest1 (DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))
oracle 127579 127518 0 13:59 pts/8 00:00:00 | \_ /bin/bash
oracle 129702 127579 0 14:00 pts/8 00:03:06 | \_ ./oratop
oracle 129885 129702 1 14:00 ? 00:03:52 | \_ oracleorcltest1 (DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))
root 120808 19596 0 13:58 ? 00:00:00 \_ sshd: jumpusr [priv]
jumpusr 120811 120808 0 13:58 ? 00:00:00 | \_ sshd: jumpusr@pts/38
jumpusr 120812 120811 0 13:58 pts/38 00:00:00 | \_ -bash
root 166202 120812 0 14:06 pts/38 00:00:00 | \_ sudo su - oracle
root 166207 166202 0 14:06 pts/38 00:00:00 | \_ su - oracle
oracle 166208 166207 0 14:06 pts/38 00:00:00 | \_ -bash
oracle 166828 166208 0 14:06 pts/38 00:00:00 | \_ sqlplus as sysdba
oracle 166829 166828 0 14:06 ? 00:00:00 | \_ oracleorcltest1 (DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))
oracle 273255 166828 0 14:24 pts/38 00:00:00 | \_ /bin/bash
oracle 166843 273255 0 15:13 pts/38 00:00:00 | \_ screen -R 275973.mysess_job_s1
root 337310 19596 0 14:34 ? 00:00:00 \_ sshd: jumpusr [priv]
jumpusr 337315 337310 0 14:34 ? 00:00:00 | \_ sshd: jumpusr@pts/65
jumpusr 337316 337315 0 14:35 pts/65 00:00:00 | \_ -bash
root 339018 337316 0 14:35 pts/65 00:00:00 | \_ sudo su - oracle
root 339021 339018 0 14:35 pts/65 00:00:00 | \_ su - oracle
oracle 339022 339021 0 14:35 pts/65 00:00:00 | \_ -bash
oracle 339230 339022 0 14:35 pts/65 00:00:00 | \_ sqlplus as sysdba
oracle 339231 339230 0 14:35 ? 00:00:00 | \_ oracleorcltest1 (DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))
oracle 40321 339230 0 15:58 pts/65 00:00:00 | \_ /bin/bash
oracle 41873 40321 0 15:59 pts/65 00:00:00 | \_ sqlplus as sysdba
oracle 41874 41873 0 15:59 ? 00:00:00 | \_ oracleorcltest1 (DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))
.
.
.
If you want to filter this to show only Oracle-related sessions, you can try:
ps -ef --forest | grep -E "oracle|sqlplus"
Top comments (0)