Pstree

pstree shows running processes as a tree. The tree is rooted at either pid or init if pid is omitted. If a user name is specified, all process trees rooted at processes owned by that user are shown. Platforms: *nix

Whowatch is an interactive, ncurses-based, process and users monitoring tool which updates information in real time. It can be described as an interactive mix of ps, pstree, lsof, w, finger and kill. Platforms: *nix

chkrootkit is a tool to locally check for signs of a rootkit. It contains: - chkrootkit: shell script that checks system binaries for rootkit modification. - ifpromisc.c: checks if the interface is in promiscuous mode. - chklastlog.c: checks for lastlog deletions. - chkwtmp.c: checks for... Platforms: *nix