To Find Orphan OS processes.
When a process run from command line its parent process id will be 1. Consider following example:
In current session, we are executing SQLPLUS. whose process id = 22833 and parent is 22822.
process 22822 is ksh. So this is not orphan process. if you find any process with parent id 1, confirm with users for how this program is executed. When a process or program is running directly without Shell, it will have 1 as parent process id and orphan processes also have parent process id as 1.
SQL> !ps -ef | grep -i sqlplus
oracle 6833 22833 0 13:56:39 pts/1 0:00 grep -i sqlplus
oracle 22833 22822 0 12:04:27 pts/1 0:00 sqlplus / as sysdba
SQL> !ps -ef | grep 22822
oracle 22822 22820 0 12:04:14 pts/1 0:00 -ksh
oracle 6934 22833 0 13:57:02 pts/1 0:00 grep 22822
oracle 22833 22822 0 12:04:27 pts/1 0:00 sqlplus / as sysdba
SQL>