Zombie Processes

Before we get into the Zombie process, let me recall what a process is in Linux.

In short, a process is a program instance. It can be foreground (interactive process) or background (non-interactive or automatic process). It can be a parent process (the creator of other processes at runtime) or a child process (a process created by other processes).

In Linux, every process has a parent process, except for the first init (or systemd) process with a PID of 0. Processes also have their own child processes.

Use the pstree command to view the process tree in the terminal, and also to view the “family” of system processes. In this tutorial we will explain how to find and kill zombie processes in Linux.

What is a zombie process in Linux?

When a child process dies, it notifies the parent process so that it can do some cleanup, such as freeing memory. However, if the parent process does not know of its death, the child process will enter the zombie state. For the parent process, the child process still exists, but the child process is effectively dead. This is how zombie processes (also known as dead processes) are created and remain in the system.

Do we need to worry about zombie processes?

Truth be told zombie processes are not as dangerous as their name sounds.

Problems can occur if your system has limited memory or if there are too many zombie processes taking up memory. In addition, most Linux processes can have a maximum PID of 32768, and your system may crash if other processes do not have available IDs.

This is rare, but it can happen, especially if a poorly coded program starts spawning a lot of zombie processes. In this case, it is best to find and kill the zombie processes.

How to find zombie processes?

A process in Linux can have one of the following states.

  • D = uninterrupted sleep
  • I = idle
  • R = Running
  • S = Sleeping
  • T = Stopped by job control signal
  • t = Stopped by debugger during trace
  • Z = Zombie

But where can you see the processes and their respective status? An easy way is to use the terminal and top commands.

Linux top

As you can see in the screenshot above, there are a total of 250 tasks (or processes), 1 is running, 248 processes are dormant, and 1 is in a zombie state.

How do I find and kill a zombie process? Can zombie processes be killed?

A zombie process is already dead. How do you kill a process that is already dead?

In zombie movies, you can shoot a zombie in the head or set it on fire. But that’s not a good option here. You can burn your system to kill the zombie process, but that’s not a good solution ;)

Some people suggest to send SIGCHLD signal to the parent process. But it is more likely to be ignored. An alternative to killing a zombie process is to kill its parent process. This sounds cruel, but it is the only reliable way to kill a zombie process.

So, first, let’s list the zombie processes so we know their IDs, which can be done by using the ps command in the terminal.

1

ps ux | awk '{if($8=="Z+") print}'

Column 8 of the ps ux command output shows the status of the process. You are asked to print all matching rows for which the process status is Z+ (indicating zombie status).

After determining its process ID, let’s get its parent process ID.

1

ps -o ppid= -p <child_id>

Alternatively, you can combine the above two commands in the following way, which directly provides the PID of the zombie process and the PID of its parent process.

1

ps -A -ostat,pid,ppid | grep -e '[zZ]'

Here you get the parent process ID, so finally you terminate the process by entering the corresponding ID process you got earlier in the command line.

1

kill -9 <parent_process_ID>

linux kill

You can verify that the zombie process is killed by running the ps command again or even the top command.

Now you know how to get rid of zombie processes.