What is a Zombie Process?

Interestingly, it seems that many search engines want to provide my blog as a result when folks want to know something about zombie processes, even though this site has nothing to do with them per se.  As such, I will discourse for a bit on the seemingly morbid topic of Zombie Processes, this site’s namesake.

What is a zombie process?

When a process finishes execution, it will have an exit status to report to its parent process. Because of this last little bit of information, the process will remain in the operating system’s process table as a zombie process, indicating that it is not to be scheduled for further execution, but that it cannot be completely removed (and its process ID cannot be reused) until it has been determined that the exit status is no longer needed.

When a child exits, the parent process will receive a SIGCHLD signal to indicate that one of its children has finished executing; the parent process will typically call the wait() system call at this point. That call will provide the parent with the child’s exit status, and will cause the child to be reaped, or removed from the process table.

How do I see if there are zombie processes on a system?

Run “ps aux” and look for a Z in the STAT column.

How do I remove zombie processes from a system?

Well, first you can wait. It’s possible that the parent process is intentionally leaving the process in a zombie state to ensure that future children that it may create will not receive the same pid. Or perhaps the parent is occupied, and will reap the child process momentarily.

Secondly, you can send a SIGCHLD signal to the parent (“kill -s SIGCHLD <ppid>“). This will cause well-behaving parents to reap their zombie children.

Finally, you can kill the parent process of the zombie. At that point, all of the parent’s children will be adopted by the init process (pid 1), which periodically runs wait() to reap any zombie children.

Why did you name your blog Zombie Process?

Glad you asked.


30 comments

  1. Trying to kill follow the above process. but no result is same ….
    Last try to “killall pid” and and the zombie and its parents are cleared from the process list..

    Riyad

  2. @sternr:

    Sorry to say that there is no indication that a zombie process has been reaped, except by watching the process table to see when it drops off.

  3. So Mike what u mean to say is until wait() function has been called by the parent process, the child remains as a zombie process?
    If yes, then does that mean that it is mandatory to call the wait() function after the child exits?

    Thanks ahead

    Jatinder

    • Jainder:

      “Mandatory” may be a strong word, but it is certainly good programming practice. If the process is long-running (a daemon, for example), and spawns many children that are never reaped, there will be many zombie processes milling about. In the case of a short-running process, the zombie children will be adopted by the init process when the parent is terminated, and the init process will take care of reaping them.

      So, it’s not “mandatory,” but I would definitely characterize it as “highly, highly, highly recommended.”

      Thanks,
      Mike

    • I suppose it technically depends on the OS implementation, but I would not expect “kill -9” to eliminate the zombie from the process table. The process is already dead. Killing the parent of the zombie would eliminate the zombie, but I don’t think that’s what you are asking.

      To be clear, zombie processes consume so few system resources that it should not be a concern to have several lingering around. It would be a concern if there are a lot, but that would likely mean that there is a significant bug in a component of your software stack…

      Thanks,
      Mike

  4. i didn’t understood the second method of killing the zombie process,since the SIGCHILD signal is given to parent when child exits.So hw can it remove the zombie process?

    • If there is an issue in the design of the program for the parent process, it may have missed or otherwise not processed the initial SIGCHLD that was issued when the child process exited. This gives the parent process another chance to correctly handle the terminating child (presumably, the parent process is in a different state, and may be able to correctly process the signal this time around).

    • An orphan process is a running process whose parent has terminated; the parent process becomes the init process (just like a zombie process whose parent has terminated without reaping it). Orphan processes are frequently intentional; it is common for daemons to be orphan processes, for example. The nohup command is a common way to create such a process.

      Since init calls wait() periodically, an orphan process will typically not become a persistent zombie process when it exits.

    • Not really, nothing other than a space on the process table. The only reason the zombie exists is to report its exit status to a parent; no file descriptors, memory, etc. are maintained.

  5. Mikee,
    I got it that zombie process has little overhead as its occupying process Id and probably kernel will not destroy related Data.

    But is there any side effect of Orphan Process??

  6. if the parent explicitly ignores SIGCHLD by setting its handler to SIG_IGN (rather than simply ignoring the signal by default) or has the SA_NOCLDWAIT flag set, all child exit status information will be discarded and no zombie processes will be left.

    can u explain this once.

  7. Can you tell me sumthng abt the fork proc?? and also that since every proc uses a fork proc to create a new proc then who creates that new proc??

  8. What will happen to child processes if –
    a) they are running
    or
    b) in zombie state
    or
    c) terminated (is it possible?)
    and parent is exited without waiting for children?

  9. Hi mike,

    I read your article. I already know about all zombie process and as well as about bots on internet. I am new to ubuntu and i have seen a process “zeitgeist-datah” running in zombie state. I have studied about DDOS attack. I am worried that is this process which is running in zombie state is safe or not. I am using ubuntu 11.4 natty version. how to know about his parent so, i can kill this zombie by its parent ID.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s