Interestingly, it seems that many search engines want to provide my blog as a result when folks want to know something about zombie processes, even though this site has nothing to do with them per se. As such, I will discourse for a bit on the seemingly morbid topic of Zombie Processes, this site’s namesake.
What is a zombie process?
When a process finishes execution, it will have an exit status to report to its parent process. Because of this last little bit of information, the process will remain in the operating system’s process table as a zombie process, indicating that it is not to be scheduled for further execution, but that it cannot be completely removed (and its process ID cannot be reused) until it has been determined that the exit status is no longer needed.
When a child exits, the parent process will receive a SIGCHLD signal to indicate that one of its children has finished executing; the parent process will typically call the wait() system call at this point. That call will provide the parent with the child’s exit status, and will cause the child to be reaped, or removed from the process table.
How do I see if there are zombie processes on a system?
Run “ps aux” and look for a Z in the STAT column.
How do I remove zombie processes from a system?
Well, first you can wait. It’s possible that the parent process is intentionally leaving the process in a zombie state to ensure that future children that it may create will not receive the same pid. Or perhaps the parent is occupied, and will reap the child process momentarily.
Secondly, you can send a SIGCHLD signal to the parent (“kill -s SIGCHLD <ppid>“). This will cause well-behaving parents to reap their zombie children.
Finally, you can kill the parent process of the zombie. At that point, all of the parent’s children will be adopted by the init process (pid 1), which periodically runs wait() to reap any zombie children.
Why did you name your blog Zombie Process?
RSS Feed - All
Monday, 9 Feb 2009 at 5:46 am
Trying to kill follow the above process. but no result is same ….
Last try to “killall pid” and and the zombie and its parents are cleared from the process list..
Riyad
Tuesday, 10 Mar 2009 at 3:32 pm
ps -eo pid,ppid,user,args,stat –sort stat
ppid is the parent process id
Sunday, 26 Apr 2009 at 3:48 am
Hey,
How can I know when a certain zombie process has terminated?
Thanks ahead!
–sternr
Friday, 15 May 2009 at 2:56 pm
@sternr:
Sorry to say that there is no indication that a zombie process has been reaped, except by watching the process table to see when it drops off.
Sunday, 24 May 2009 at 2:54 am
So Mike what u mean to say is until wait() function has been called by the parent process, the child remains as a zombie process?
If yes, then does that mean that it is mandatory to call the wait() function after the child exits?
Thanks ahead
Jatinder
Thursday, 11 Jun 2009 at 12:17 pm
Jainder:
“Mandatory” may be a strong word, but it is certainly good programming practice. If the process is long-running (a daemon, for example), and spawns many children that are never reaped, there will be many zombie processes milling about. In the case of a short-running process, the zombie children will be adopted by the init process when the parent is terminated, and the init process will take care of reaping them.
So, it’s not “mandatory,” but I would definitely characterize it as “highly, highly, highly recommended.”
Thanks,
Mike
Sunday, 5 Jul 2009 at 5:29 am
what happens when we directly send kill signal to
zombie process by
kill -9 pid
pid -zombie process pid
Thursday, 9 Jul 2009 at 1:25 pm
I suppose it technically depends on the OS implementation, but I would not expect “kill -9″ to eliminate the zombie from the process table. The process is already dead. Killing the parent of the zombie would eliminate the zombie, but I don’t think that’s what you are asking.
To be clear, zombie processes consume so few system resources that it should not be a concern to have several lingering around. It would be a concern if there are a lot, but that would likely mean that there is a significant bug in a component of your software stack…
Thanks,
Mike
Wednesday, 9 Dec 2009 at 1:19 am
i didn’t understood the second method of killing the zombie process,since the SIGCHILD signal is given to parent when child exits.So hw can it remove the zombie process?
Wednesday, 9 Dec 2009 at 11:17 am
If there is an issue in the design of the program for the parent process, it may have missed or otherwise not processed the initial SIGCHLD that was issued when the child process exited. This gives the parent process another chance to correctly handle the terminating child (presumably, the parent process is in a different state, and may be able to correctly process the signal this time around).
Friday, 11 Dec 2009 at 1:09 pm
No one can kill Zombie even in real world.
Wednesday, 27 Jan 2010 at 9:50 am
can u tell me something about orphan processes???
Friday, 23 Jul 2010 at 8:45 am
An orphan process is a running process whose parent has terminated; the parent process becomes the init process (just like a zombie process whose parent has terminated without reaping it). Orphan processes are frequently intentional; it is common for daemons to be orphan processes, for example. The nohup command is a common way to create such a process.
Since init calls wait() periodically, an orphan process will typically not become a persistent zombie process when it exits.
Saturday, 13 Mar 2010 at 1:10 am
zombie is a process not to removed at all
Friday, 23 Jul 2010 at 4:22 am
I read about zombie processes.. I just want to ask do they hold resources even after that process has finished its execution???
Friday, 23 Jul 2010 at 8:39 am
Not really, nothing other than a space on the process table. The only reason the zombie exists is to report its exit status to a parent; no file descriptors, memory, etc. are maintained.
Wednesday, 1 Sep 2010 at 3:53 am
how to kill a process?
Monday, 25 Oct 2010 at 11:28 am
Mikee,
I got it that zombie process has little overhead as its occupying process Id and probably kernel will not destroy related Data.
But is there any side effect of Orphan Process??
Wednesday, 19 Jan 2011 at 11:52 pm
Hi Mike,
Can you suggest me how to create a zombie process?
Friday, 4 Feb 2011 at 7:54 pm
if the parent explicitly ignores SIGCHLD by setting its handler to SIG_IGN (rather than simply ignoring the signal by default) or has the SA_NOCLDWAIT flag set, all child exit status information will be discarded and no zombie processes will be left.
can u explain this once.
Thursday, 10 Mar 2011 at 1:59 am
Really nice article. Thanx for clearing up few confusions.
Wednesday, 20 Apr 2011 at 10:57 am
Can you comment on ninja and pirate processes? There are zombies and daemons so I assume these two must also exist.
Sunday, 1 May 2011 at 12:41 pm
Is there a method to forcefully remove the zombie process on Linux like the Solaris preap command if the ppid is already 1.
Thursday, 16 Jun 2011 at 3:21 am
Can you tell me sumthng abt the fork proc?? and also that since every proc uses a fork proc to create a new proc then who creates that new proc??
Friday, 8 Jul 2011 at 6:39 am
What will happen to child processes if –
a) they are running
or
b) in zombie state
or
c) terminated (is it possible?)
and parent is exited without waiting for children?
Tuesday, 27 Sep 2011 at 1:46 pm
If the parent dies, the process becomes an orphan process and init takes control, and can then do whatever it wants with the process.
Wednesday, 17 Aug 2011 at 2:18 am
Can you explain the interrupted system call signal
Thursday, 20 Oct 2011 at 9:41 am
Hi mike,
I read your article. I already know about all zombie process and as well as about bots on internet. I am new to ubuntu and i have seen a process “zeitgeist-datah” running in zombie state. I have studied about DDOS attack. I am worried that is this process which is running in zombie state is safe or not. I am using ubuntu 11.4 natty version. how to know about his parent so, i can kill this zombie by its parent ID.
Thursday, 20 Oct 2011 at 1:17 pm
You can obtain the PID of the parent process with “ps -fe”. The value in the PPID column is the one you are looking for.
Tuesday, 29 Nov 2011 at 2:43 pm
Thanks about your help. i am very glad.
Souvik