If you are an experienced UNIX or Linux administrator you probably know this already, but this question came to me lately, and I found it worth a little article.
What is a Zombie Process ?
A zombie process is a process which has already died, but it is still visible in the process list. It is also known as a defunct process.
Why are they sometimes present ?
Normally, when a parent process spawns a child process, it issues a wait() function, so that it knows when the child process has exited and collects any leftover data (like an errorlevel, for instance). If by any chance the parent process doesn’t wait for the child process to exit (bad programming), the child wont get reaped when it dies. Hence, you will get a zombie process. So actually it isn’t a process at all. It is just visible as a leftover in the process list. It’s not really there…that’s why it is called a zombie, a ghost.
How can I kill a Zombie process ?
Well, since a zombie process isn’t a real process, but just a line in a table (the process table), you can not kill it. kill -9 won’t help either. As said, it’s not really there. Sorry.
(Note that the kill -9 command should really only be used as a last resort. Just the standard kill
How do I get rid of a Zombie ?
You can get an axe, chop off his head, or pump some lead bullets in its body…not sure it will help though… Sorry…that’s lame..
The only way to get rid of a zombie process is to kill the parent process. In top you can see it’s parent process and ps has commandline options for that as well. You will have to ask yourself if you want to kill that particular process, though…
A word of caution! Killing a parent process can be dangerous in some cases. Especially when you see that the parent process is 0 (kernel) or 1 (init). Please do not try to kill those processes.
In most cases it is no problem to leave the zombies as they are. They are not taking up much resources anyway. Just leave them be, and your system will stay healthy.
~ Rick
kill -1 -1 is an effective way to get rid of zombie processes.
Hi Jason,
kill -1 -1 gives a HUP signal to all processes under your current uid, including parent processes. Although I have never tried this before with zombies, I can imagine that some parent processes might not react to a HUP signal (if poorly written, for instance). If that is the case, your solution might not work.
Cheers,
~ Rick
Interesting article @Umask thanks for sharing this.
The following will work in Solaris 10 and later:
#!/bin/ksh
###
### Korn shell script to clear zombie processes.
### Run at command line with ‘nohup zombie_clear.ksh’ or use crontab.
###
### Respond to hardware signals
trap ” 1 2 15
while :
do
### Use ‘ps -el’ and pull out the status
for x in `ps -el | awk ‘$2 ~ /Z/ {print $4}’`
do
### Force defunct process to be reaped by its parent
preap $x
done
#sleep 86400 # every 24 Hrs.
done
trap 1 2 15
exit 0;
@Ron Halstead – Thanks, buddy, seems like you have found a solution for Solaris 10. This program isn’t there on other systems though, afaik.
Cheers !
~ Rick
Actually, the dreaded zombie process is still consuming some resources (although not much). It is consuming a slot in the process table. On modern systems, this is no big deal as the process table is dynamically sized, but on older systems that had a fixed process table size it could be troublesome.
The data that the zombie is saving includes the exit status of the program (including whatever value was passed to the exit(2) system call) and any resource utilization data associated with the exited process. The intention is that the parent process will call the wait(2) system call and retrieve this information.
When you write a program that is going to fork off children, you should arrange to reap them. A simple way to do this is to set up a signal handler for SIGCHLD and have the signal handler function call wait(2) for you. Another way is to use a non-blocking wait (i.e., use waitpid(2) instead of wait(2) and pass the WNOHANG flag) and call it periodically in your parent program’s main loop. Shells often call wait(2) just before printing a prompt, for example.
Unix, and unix-like systems (like Linux) will maintain a tree structure of process ancestry. Each time a process forks, you end up with two processes, one being the parent and one being the child. If a child process exits, it’s up to it’s parent to wait for it. If the parent happens to exit without waiting for the child, then the child’s status is “inherited” by the parent’s parent. Ultimately, the grandfather process (init, pid 1) will inherit any process that doesn’t have any other parents. init’s job is to wait for things, so it will definitely reap your zombie processes if it gets that far. If you see a zombie process in the process table, and it’s parent process is 1, then you’ve got bigger problems than just having zombie processes.
Good article. Thanks for sharing some good information.
@jlp
Thanks for clarifying some things for our readers. Glad you like the article.
Cheers !
~ Rick