Killing zombie process in linux

Best way to kill Zombie and D state processes in linux

Actually, reboot. There’s no real way to easily get rid of a zombie, but there’s really no reason to because a zombie isn’t taking up resources on the computer; it’s an orphaned entry in a process table. Init is supposed to collect it but something went wrong with the process. http://en.wikipedia.org/wiki/Zombie_process

Perhaps you’re asking because there’s worse problem. are you getting a boatload of zombies roaming your process table? That usually means a bug in the program or a problem with a configuration. You shouldn’t have a huge number of zombies on the system. One or two I don’t worry. If you have fifty of them from Apache or some other daemon, you probably have a problem. But that’s not directly related to your question.

You can’t kill a zombie — its already dead

If the ppid still exists, then terminating that can often clean up the spawned zombies.

You shouldn’t be killing processes in uninterruptible sleep — usually this means they’re i/o bound, but IIRC it can also occur during a blocking read from e.g. a network socket.

Errors in underlying filesystem or disks might cause I/O bound processes. In this case try to «umount -f» the filesystem they depend upon — this will abort whatever outstanding I/O requests there are open.

You lose data anyway by reboot. This way you might avoid reboot — useful feature on production or development systems.

Thanks, this worked for an issue we had with a script stuck attempting to access a disappeared NFS mount for weeks 🙂

This is exactly what is happening to me sometimes when I do the ls command on a s3fs mount. The ls process won’t kill even with kill -9 until I force the unmount with umount -l . Alternatives to umount?

Most answers focus on Zombies, this targets D state

Processes that are stuck in «uninterruptible sleep» show up in a process list as being in state D

In my experience, these are frequently blocked on I/O in some way. If you’ve been reading files from a mounted network disk and the remote host has restarted or network connectivity has failed in some way, then the copy process can be stuck waiting indefinitely.

The only fixes are to just kill the process, or to umount -f /mnt/source to unmount the disk, and then the process will see that it has gone, and will fail cleanly. Obviously the I/O action will be incomplete too, likely with a partial file copy.

Related, tar and rsync process can be in this state while running through SSH — they are literally blocked waiting for the network to catch up. Point is that state D is not necessarily bad, so killing them all may not be an ideal solution.

Источник

How to find and kill zombie processes in Linux

Before we get into the Zombie process, let me recall what a process is in Linux. In short, a process is a program instance. It can be foreground (interactive process) or background (non-interactive or automatic process). It can be a parent process (the creator of other processes at runtime) or a child process (a process created by other processes). In Linux, every process has a parent process, except for the first init (or systemd) process with a PID of 0. Processes also have their own child processes. Use the pstree command to view the process tree in the terminal, and also to view the “family” of system processes. In this tutorial we will explain how to find and kill zombie processes in Linux.

What is a zombie process in Linux?

When a child process dies, it notifies the parent process so that it can do some cleanup, such as freeing memory. However, if the parent process does not know of its death, the child process will enter the zombie state. For the parent process, the child process still exists, but the child process is effectively dead. This is how zombie processes (also known as dead processes) are created and remain in the system.

Do we need to worry about zombie processes?

Truth be told zombie processes are not as dangerous as their name sounds. Problems can occur if your system has limited memory or if there are too many zombie processes taking up memory. In addition, most Linux processes can have a maximum PID of 32768, and your system may crash if other processes do not have available IDs. This is rare, but it can happen, especially if a poorly coded program starts spawning a lot of zombie processes. In this case, it is best to find and kill the zombie processes.

How to find zombie processes?

• D = uninterrupted sleep
• I = idle
• R = Running
• S = Sleeping
• T = Stopped by job control signal
• t = Stopped by debugger during trace
• Z = Zombie

But where can you see the processes and their respective status? An easy way is to use the terminal and top commands.

As you can see in the screenshot above, there are a total of 250 tasks (or processes), 1 is running, 248 processes are dormant, and 1 is in a zombie state.

How do I find and kill a zombie process? Can zombie processes be killed?

A zombie process is already dead. How do you kill a process that is already dead?

In zombie movies, you can shoot a zombie in the head or set it on fire. But that’s not a good option here. You can burn your system to kill the zombie process, but that’s not a good solution 😉

Some people suggest to send SIGCHLD signal to the parent process. But it is more likely to be ignored. An alternative to killing a zombie process is to kill its parent process. This sounds cruel, but it is the only reliable way to kill a zombie process.

So, first, let’s list the zombie processes so we know their IDs, which can be done by using the ps command in the terminal.

Column 8 of the ps ux command output shows the status of the process. You are asked to print all matching rows for which the process status is Z+ (indicating zombie status).

After determining its process ID, let’s get its parent process ID.

Alternatively, you can combine the above two commands in the following way, which directly provides the PID of the zombie process and the PID of its parent process.

ps -A -ostat,pid,ppid | grep -e '[zZ]' 

Here you get the parent process ID, so finally you terminate the process by entering the corresponding ID process you got earlier in the command line.

You can verify that the zombie process is killed by running the ps command again or even the top command.

Now you know how to get rid of zombie processes.

Источник

How to Find and Kill a Zombie Process on Linux

A zombie is a creature that was a human and died but somehow due to a virus or any reason it woke up again. It is already dead but is walking and moving. This is the concept of a zombie described in movies and novels. In the same way in Linux, a zombie process is a process that was removed from the system as “defunct” but still somehow runs in the system memory is called zombie process. Until a child process is eliminated from a process table, it turns into a zombie first.

A process in the terminated state is another name for it. It is cleaned from the memory using its parent process. When the parent process is not notified of the change, the child process becomes the zombie process and it does not get any signal of termination so that it can leave the memory. In Linux, whenever a process is removed from the memory, its parent process is informed about the removal. This process stays in the memory until it notifies its parent process.

This means that the dead process is not removed from the memory immediately and it continues in the system memory thus becoming a zombie process. To remove a zombie process, the parent process calls the wait() function. Once the wait() function is called into play, the zombie process is completely removed from the system.

Killing a Zombie Process

Before moving to kill the zombie process, we will first discuss the zombie process risks and the causes of the zombie process taking place. Also, we will learn more about the zombie process to make it easy to understand the killing process.

What is the Cause of the Zombie Process

There can be two major causes of the zombie process. The first one is the one in which the parent process is unable to call the wait() function when the child creation process is running which leads to ignoring the SIGCHLD. This may cause the zombie process. The second is the one in which the other application may affect the parent process execution due to bad coding or malicious content in it.

In other words, we can say that the zombie process is caused when the parent process ignores the child process state changes or it cannot check the state of the child process, when the child process ends the PCB is not cleared.

Does the Zombie Process Pose a Risk

The zombie process does not pose any risk, they just use some part of memory in the system. The process table is of small size but the id of the table where the zombie process is stored cannot be used until it is released by the zombie process. But in case there are a lot of zombie processes reserving the memory location and no memory space left for other processes to take place, it becomes difficult for other processes to run.

Finding a Zombie Process

Before killing the zombie process it is necessary to find them. To find the zombie process we will run the following command in the terminal:

In the command above, “ps” stands for the process state it is used to view the state of the process that is running in the system along with the ps command. We passed the flag aux in which “a” indicates the details of all associated processes in the terminal, “u” indicates the processes that are in the user list and the “x” indicates the processes that are not executed from the terminal. In combination, we can say that it is used to print all of the running processes that are stored in the memory.

The second option passed “egrep” is a processing tool that is used to fetch the expressions or patterns in a specified location. Lastly, we passed the “Z|defunct” keyword which denotes the zombie process that is to be fetched in the memory. When we execute the command, we will get the following output, which shows the zombie process in the system along with its “PID”.

USER PID % CPU % MEM VSZ RSS TTY STAT START TIME COMMAND
linux 33819 0.0 0.0 18008 724 pts / 0 S+ 20 : 22 0 :00 grep -E —color =auto Z | defunct

Zombie processes are already dead processes but the parent process is unable to read its status and cannot be released from memory. So, the dead process cannot be killed. We can only do for them to enable the parent process to read the child state so it can be executed and removed from the process table. For this, we will run the command mentioned below.

In the above command, we tried to get the parent id of the zombie process. After getting the parent id, we will run the following command to kill the zombie process by sending the SIGCHLD to the parent process which enables the parent process to read the child state:

In the command above, we pass the signal to the parent id to kill the zombie process of the parent id passed to it. After the above command is executed, it will simply move to the next line without printing any output on the terminal in case no parent id exists. To check for the process whether the zombie process is killed or not, you can run the command that we already executed to find the zombie process.

Let us try another way to kill the zombie process which is done by killing the parent process itself. This is the more efficient way to kill the zombie process because it will completely remove the whole process and won’t allow the zombie to arise again. For that, we will run the below-shown command:

After running the above command, we allow the system to kill the parent process.

Conclusion

We have briefly discussed the zombie process and also the causes and the procedure to kill these processes. Before heading to our killing process, we tried to explain the reasons for their cause and also the ways to identify them using simple commands.

About the author

Kalsoom Bibi

Hello, I am a freelance writer and usually write for Linux and other technology related content

Источник