What is Zombie process in linux and how to identify and how to kill

Zombie Process in Linux

A zombie process is a process that has completed execution but still has an entry in the process table. This happens when the parent process has not yet read the exit status of the terminated child process using the wait() system call.

Even though zombies do not consume CPU or memory, having too many of them can exhaust system resources (as the process table has a limited number of entries).

---

How to Identify Zombie Processes

You can identify zombie processes using the following methods:

1. Using ps command
   Run:

   
   
   ps aux | grep 'Z'
   

   or

   
   ps aux | awk '{ if ($8 ~ /Z/) print }'
   

   The process state (STAT column) will be Z for zombie processes.

2. Using top command
   Run:

   
   
   top
   

   Look for processes with the Z state in the STAT column.

3. Using htop command (if installed)
   Run:

   
   
   htop
   

   Look for processes marked as zombie.

---

How to Kill a Zombie Process

You cannot directly kill a zombie process because it is already terminated. However, you can remove it in the following ways:

1. Kill the Parent Process

Since the zombie process exists due to the parent not cleaning up, killing the parent process will usually remove the zombie.

• Find the parent process ID (PPID) of the zombie process:

  bash
  
  ps -o ppid= -p <Zombie_PID>
  

• Kill the parent process:

  
  kill -9 <Parent_PID>
  

  ⚠️ Warning: Killing a critical system process may cause system instability.

2. Restart the Parent Process

Instead of killing the parent, you can try restarting it gracefully so it reaps the zombie:

bash

kill -SIGHUP <Parent_PID>

3. Fork Bomb Prevention (Last Resort)

If zombie processes are accumulating due to bad programming, rebooting the system will clear all zombies. However, fixing the parent process code to properly use wait() or waitpid() is the best solution.

---

Preventing Zombie Processes

Developers should ensure that the parent process handles child termination correctly using:

• wait()
• waitpid()
• Setting SIGCHLD to SIG_IGN to automatically reap child processes.

=================================================================

In Linux, a zombie process, also known as a defunct process, is a process that has completed its execution but still has an entry in the process table. This entry is needed for the parent process to read the child's exit status. Once the exit status is read, the zombie's entry is removed from the process table.

Why do zombie processes occur?

When a child process finishes its task, it sends a signal to its parent process. The parent process is then supposed to acknowledge this signal and "reap" the child process, removing it from the process table. However, if the parent process fails to do this, the child process remains in the zombie state.

How to identify zombie processes:

You can use the ps command to list all processes and look for the "Z" state. Here's the command:

Bash

ps aux | grep Z

This command will show you all processes with a "Z" in the STAT column, indicating that they are zombies.

How to kill zombie processes:

Zombie processes are already dead, so you can't kill them in the traditional sense. The goal is to make the parent process acknowledge the child's termination. Here are a few methods:

1. Send a signal to the parent process:

   • Find the parent process ID (PPID) of the zombie process using ps aux | grep <zombie_PID>.
   • Send a SIGCHLD signal to the parent process using kill -s CHLD <PPID>. This signal prompts the parent to handle the terminated child.

2. Kill the parent process:

   • If the parent process is not critical, you can kill it using kill <PPID>. This will also remove the zombie process.

3. Reboot the system:

   • If all else fails, rebooting the system will clear all processes, including zombies.

Important notes:

• Zombie processes consume minimal system resources, mainly a process table entry.
• A few zombie processes are usually not a cause for concern.
• A large number of zombie processes might indicate a problem with a parent process or the system's process management.
• Killing the parent process might not always be desirable, especially if it's a critical system process.