What Is Zombie Process ? How To Kill Zombie Process In Linux

What is a zombie process?

In Linux OS, a zombie process or a defunct process is a finished (died) process, but it has still occupied an entry in the process table. Normally, a child process that has completed its execution will send a SIGCHLD signal to the parent process which has created it. Then the parent process will send a wait system call through which it can read the child’s exit status. After receiving the wait system call, the child’s entry will get removed from the process table. In some cases, parent may ignore the SIGCHLD signal which causes the finished process to still exist in the process table which makes it a zombie process. Sometimes this is desirable for the parent process to ensure that it doesn’t allocate the same PID to another child. When a process becomes dead, it will free up the memory and other resources allocated to it. So, a zombie process will not be using any resources at all, other than an entry in the process table. The problem may start only when a large number of zombie processes exist and system run out of PIDs. In this article, we will see how a zombie process can be detected and terminated.

If the system generates large number of zombie processes, then it should be an application bug which needs to be checked for available patches to correct the problem.

Detecting Zombie processes

You can find the zombie processes using Linux ‘ps’ command. This command will list all processes with a “STAT” column. If the process is a zombie process, the STAT column will have the character “Z”. Using any of the following commands, you can find the zombie processes.

ps aux | awk ‘{ print $8 ” ” $2 }’ | grep -w Z
ps –el | grep Z

Handling Zombie process

As zombie processes doesn’t consume any resources, you can ignore it if the server runs smoothly. But in case of server facing heavy load, large number of zombie processes may become an issue. So, in order to get rid of the zombie processes we can consider any of the following methods.

1. Sending SIGCHLD signal to the parent process of zombie

Upon receiving SIGCHLD command, the parent process must send a wait system call which will remove the zombie process. This can be accomplished by executing the following command.

kill -s SIGCHLD

PPID is the PID of the parent process which invoked the zombie child process. You can execute the following command to find the PPID of a zombie process.

ps aux -eo ppid | grep

If the parent process explicitly ignores the SIGCHLD signal, you should considering killing the parent process (step 2).

2. Killing the Parent process

If the zombie processes are not able to get removed, you should kill the parent process or restart the service to get rid of the zombies. When a parent gets killed, all child processes will become the child process of ‘init process (PID 1)’. Init process will wait for the children to die by sending a wait signal which in turn removes the zombie processes.

The parent process can be killed using the ‘kill’ command.

kill -9