Find out the shell which was used to run the process in linux?

I recently got stuck in a situation where I need to find out the name of the shell for a list of process (or for a single process, using pid). Is there a way we can find it out (preferably using ps and grep command).

Answer

Since you know that the processes have been started from a shell, you just have to find the command name of the parent process, whose process id can be obtained using ps, e. g. with the OUTPUT FORMAT CONTROL option oppid.

for pid in ${list[*]}; do echo -n $pid:; ps p`ps p$pid hoppid` hocomm; done

Details

for pid in ${list[*]}; do …; done

The commands … are executed once for each element in list with the variable pid set to each element (process ID) in turn. See Looping Constructs.

The construct ${list[*]} expands to all elements in list; in bash this works if list is an array variable (set by e. g. list=(1234 5678)) as well as if list is a simple variable with white-space-separated elements (set by e. g. list="1234 5678"). See Shell Parameter Expansion and Arrays.

echo -n $pid:

outputs e. g. 1234: without a newline, so that following output appears directly behind the :. See Bash Builtin Commands.

ps p$pid hoppid

The Process Selection option p selects the process(es) for which information is to be shown, in this case $pid.
The Output Modifier h suppresses printing of column header, e. g. PPID.
The Output Format Control option o is used to choose the information supplied by ps, in this case just ppid, the parent process ID.

ps p`…` hocomm

The previous command’s output (which is the parent process ID) replaces the backquoted command, so that we get a ps command quite similar to the one described above, this time with the parent selected and its command name chosen for output by comm.

See Command Substitution and ps – report process status.