- Linux for freshers
- How to Kill Zombie Processes in Ubuntu
- Viewing Zombie Processes
- Through the GUI
- Through the Command Line
- Killing a Zombie-Process
- Through the GUI
- Through the Command Line
- How to kill a process with parent 1
- How To Kill Defunct Or Zombie Process?
- Surendra Anne
- Latest posts by Surendra Anne (see all)
Linux for freshers
A «defunct» processes is also known as a «zombie» processes. A Zombie process is referred as dead process which is receding on your system though it’s completed executing. In one shot we can say it’s a dead processes which is still in RAM. This process will be in your process table and consuming your memory. Having more defunct process will consume your memory which intern slows your system. We have to kill the defunct process in order to free RAM and make system stable.
When a process finishes execution, it will have an exit status to report to its parent process. Because of this last little bit of information, the process will remain in the operating system’s process table as a zombie process, indicating that it is not to be scheduled for further execution, but that it cannot be completely removed (and its process ID cannot be reused) until it has been determined that the exit status is no longer needed.
When a child exits, the parent process will receive a SIGCHLD signal to indicate that one of its children has finished executing; the parent process will typically call the wait() system call at this point. That call will provide the parent with the child’s exit status, and will cause the child to be reaped, or removed from the process table.
Ans : When ever a process ends all the memory used by that process are cleared and assigned to new process but due to programming errors/bugs some processes are still left in process table. These are created when there is no proper communication between parent process and child proces
Well, first you can wait. It’s possible that the parent process is intentionally leaving the process in a zombie state to ensure that future children that it may create will not receive the same pid. Or perhaps the parent is occupied, and will reap the child process momentarily.
Secondly, you can send a SIGCHLD signal to the parent (“kill -s SIGCHLD
Finally, you can kill the parent process of the zombie. At that point, all of the parent’s children will be adopted by the init process (pid 1), which periodically runs wait() to reap any zombie children. Then system need reboot to kill zombie process.
How to Kill Zombie Processes in Ubuntu
A zombie or a defunct process in Linux is a process that has been completed, but its entry still remains in the process table due to a lack of correspondence between the parent and child processes. Usually, a parent process keeps a check on the status of its child processes through the wait() function. When the child process has finished, the wait function signals the parent to completely exit the process from the memory. However, if the parent fails to call the wait function for any of its children, the child process remains alive in the system as a dead or zombie process. These zombie processes might accumulate, in large numbers, on your system and affect its performance. In that case, you might have to kill these zombies manually through the ways and commands described in this tutorial.
This tutorial is compatible with all recent Ubuntu versions including Ubuntu 22.04.
Viewing Zombie Processes
You can check your system’s performance by looking at the various processes running on your system, including efficiency-altering zombie processes. Ubuntu allows you to view these processes in the following way:
Through the GUI
In order to graphically view any zombie processes running on your system, open the System Monitor utility through your Ubuntu Dash. In the following screenshot of my System Monitor, you can view that there are two zombies running on my system. It is also possible that the number of zombie processes on your system might be less or more than the ones running on mine.
Through the Command Line
The top command displays a detailed view of the processes running on your system along with the memory and CPU resources they are using. It also gives you information about any zombie processes running on your system. Open the Terminal by pressing Ctrl+Alt+T and then type top. I got the following output after running this command.
You can see in the second line that there is 1 zombie process running on my system.
If you want further details about the zombie process, use the following command:
$ ps axo stat,ppid,pid,comm | grep -w defunct
This command will give you the state, parentID, the process ID, the program that is running the zombie process(a dummy program by the name ‘zombie’ on my system). The defunct flag tells you that this is a dead, zombie process.
Killing a Zombie-Process
First, let us understand how zombie processes are a threat to our system’s performance. It is important to learn that zombies are dead and mostly complete processes that do not take memory or CPU resources. However, each of these processes has a unique process ID assigned to them which comes from a limited pool of PIDs reserved for your processor. If a large number of zombies gather, they will eat up most part of the PID pool and the new processes will not be able to launch due to the lack of a process ID.
A small number of defunct programs occupying your system is not a big threat but that means that their parent programs have not been able to call them off due to a bug or a missing wait() function.
When a parent process has not been able to call the wait() function automatically, we need to manually signal the parent process to run the wait function on all its children so the ones with a complete state can be called back. We can do this by running the SIGCHLD command. When that doesn’t work, we can manually kill the parent process so that all its zombie children are also killed, freeing the process IDs for the new processes.
You can kill the zombie processes through the following ways:
Through the GUI
You can kill a zombie process graphically through the System Monitor Utility as follows:
- Open the System Monitor utility through Ubuntu Dash.
- Search for the term Zombie through the Search button.
- Select the zombie process, right-click and then select Kill from the menu.
The zombie process will be removed from your system.
Through the Command Line
After you know that there are any zombie processes running on your system through the top command. This is how to view the details of the processes.
The usual way is to use the following command that signals the zombie’s parent process to kill the command.
This command may not work in a few cases as not all parent processes are programmed properly in order to check upon the child processes. In that case, you can kill the parent process through the following command:
When you have killed all the zombie processes this way and run the top command, you will be able to see that there are no zombie processes running on your system anymore:
After working along with this tutorial, you can optimize your operating system by looking for any zombie processes on your system and killing them manually through the command line or the graphical user interface. This act will free up process IDs for the new processes that you want to run on your system.
How to kill a process with parent 1
My question is, how can I kill this process? Its parent is 1, which is init, as far as I know, and I wouldn’t want to kill the init process, would I? ‘Normally’ killing this process does not work:
[root@backup ~]# kill -0 5825 [root@backup ~]# kill -9 5825 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME bacula-sd 5825 root cwd DIR 253,0 4096 3801089 /root bacula-sd 5825 root rtd DIR 253,0 4096 2 / bacula-sd 5825 root txt REG 253,0 2110599 368004 /usr/local/sbin/bacula-sd bacula-sd 5825 root mem REG 253,0 75284 389867 /usr/lib/libz.so.1.2.3 bacula-sd 5825 root mem REG 253,0 46680 3604521 /lib/libnss_files-2.5.so bacula-sd 5825 root mem REG 253,0 936908 369115 /usr/lib/libstdc++.so.6.0.8 bacula-sd 5825 root mem REG 253,0 125736 3606807 /lib/ld-2.5.so bacula-sd 5825 root mem REG 253,0 1602128 3606885 /lib/libc-2.5.so bacula-sd 5825 root mem REG 253,0 208352 3606892 /lib/libm-2.5.so bacula-sd 5825 root mem REG 253,0 125744 3606887 /lib/libpthread-2.5.so bacula-sd 5825 root mem REG 253,0 25940 3604573 /lib/libacl.so.1.1.0 bacula-sd 5825 root mem REG 253,0 15972 3604535 /lib/libattr.so.1.1.0 bacula-sd 5825 root mem REG 253,0 46548 3606908 /lib/libgcc_s-4.1.2-20080102.so.1 bacula-sd 5825 root mem REG 253,0 56422480 366368 /usr/lib/locale/locale-archive bacula-sd 5825 root 0r CHR 1,3 1545 /dev/null bacula-sd 5825 root 1r CHR 1,3 1545 /dev/null bacula-sd 5825 root 2r CHR 1,3 1545 /dev/null bacula-sd 5825 root 3u CHR 9,128 6469 /dev/nst0 bacula-sd 5825 root 4u IPv4 1023380 TCP backup:bacula-sd (LISTEN) bacula-sd 5825 root 5u IPv4 2693268 TCP backup:bacula-sd->backup:53957 (CLOSE_WAIT) bacula-sd 5825 root 7u IPv4 3248683 TCP backup:bacula-sd->backup:57629 (CLOSE_WAIT) bacula-sd 5825 root 8u IPv4 3250966 TCP backup:bacula-sd->backup:37650 (CLOSE_WAIT) bacula-sd 5825 root 9u IPv4 3253908 TCP backup:bacula-sd->backup:37671 (CLOSE_WAIT) How To Kill Defunct Or Zombie Process?
A «defunct» processes is also known as a «zombie» processes. A Zombie process is referred as dead process which is receding on your system though it’s completed executing. In one shot we can say it’s a dead processes which is still in RAM. This process will be in your process table and consuming your memory. Having more defunct process will consume your memory which intern slows your system. We have to kill the defunct process in order to free RAM and make system stable.
Why defunct process are created?
Ans : When ever a process ends all the memory used by that process are cleared and assigned to new process but due to programming errors/bugs some processes are still left in process table. These are created when there is no proper communication between parent process and child process.
1. How to find a defunct process?
And : Grep defunct value in ps -ef output
#ps -ef | grep defunct
2. How can I kill a defunct process?
And : Just use kill command
#kill defunct-pid
3. Still not able to kill?
Ans : Then use kill -9 to force kill that process
#kill -9 defunct-pid
4. Still have an issue in killing it?
Ans : Then try to kill it’s parent id and then defunct.
#kill parent-id-of-defunct-pid
Then
#kill -9 parent-id-of-defunct-pid
5. Still having defunct?
Ans : If you still find defunct process eating up RAM then last and final solution is to reboot your machine(This is not preferred on production boxes).
6.What is orphan process?
Ans : An orphan process is said to be a process which runs though parent process is terminated, these process do not know what to do and when to terminate.
7. What is difference between orphan and defunct processes?
Ans : A defunct process is a dead process where there is no execution happening where as orphan process is a live process which is still in execution state but don’t have parent process
I am having a system which daily creates defunct process, I cannot sit and kill these process on daily basis.
How to get rid of this problem?
Ans : Just write a shell script to grep defunct process and kill them by putting this script in corntab.
Surendra Anne
Mr Surendra Anne is from Vijayawada, Andhra Pradesh, India. He is a Linux/Open source supporter who believes in Hard work, A down to earth person, Likes to share knowledge with others, Loves dogs, Likes photography. He works as Devops Engineer with Taggle systems, an IOT automatic water metering company, Sydney . You can contact him at surendra (@) linuxnix dot com.
Latest posts by Surendra Anne (see all)
- Docker: How to copy files to/from docker container — June 30, 2020
- Anisble: ERROR! unexpected parameter type in action: Fix — June 29, 2020
- FREE: JOIN OUR DEVOPS TELEGRAM GROUPS — August 2, 2019
- Review: Whizlabs Practice Tests for AWS Certified Solutions Architect Professional (CSAP) — August 27, 2018
- How to use ohai/chef-shell to get node attributes — July 19, 2018