There is one zombie process linux

What are zombie processes?

With commands like top and the gui based System Monitor I can see that at the moment I have several zombie processes. What are zombie processes? Do they affect the performance of the system or the application they are zombie to. Do they use too much memory or any memory at all?

5 Answers 5

Zombies are DEAD processes. They can not be ‘kill’ (You cannot kill the DEAD). All processes eventually die, and when they do they become zombies. They consume almost no resources, which is to be expected because they are dead! The reason for zombies is so the zombie’s parent (process) can retrieve the zombie’s exit status and resource usage statistics. The parent signals the operating system that it no longer needs the zombie by using one of the wait() system calls.

When a process dies, its child processes all become children of process number 1, which is the init process. Init is always waiting for children to die, so that they don’t remain as zombies.

If you have zombie processes it means those zombies have not been waited for by their parent (look at PPID displayed by ps -l ). You have three choices: Fix the parent process (make it wait); kill the parent; or live with it. Remember that living with it is not so hard because zombies take up little more than one extra line in the output of ps.

Zombies can be identified in the output from the Unix ps command by the presence of a «Z» in the STAT column. Zombies that exist for more than a short period of time typically indicate a bug in the parent program. As with other leaks, the presence of a few zombies isn’t worrisome in itself, but may indicate a problem that would grow serious under heavier loads.

To remove zombies from a system, the SIGCHLD signal can be sent to the parent manually, using the kill command. If the parent process still refuses to reap the zombie, the next step would be to remove the parent process. When a process loses its parent, init becomes its new parent. Init periodically executes the wait system call to reap any zombies with init as parent.

There are also orphan processes which are a computer process whose parent process has finished or terminated.

A process can become orphaned during remote invocation when the client process crashes after making a request of the server.

Orphans waste server resources and can potentially leave a server in trouble (This is the biggest resource difference between zombies and orphans (Except if you see some orphan zombie movie). However there are several solutions to the orphan process problem:

1. Extermination is the most commonly used technique; in this case the orphan process is killed.
2. Reincarnation is a technique in which machines periodically try to locate the parents of any remote computations; at which point orphaned processes are killed.
3. Expiration is a technique where each process is allotted a certain amount of time to finish before being killed. If need be a process may «ask» for more time to finish before the allotted time expires.

A process can also be orphaned running on the same machine as its parent process. In a UNIX-like operating system any orphaned process will be immediately adopted by the special «init» system process. This operation is called re-parenting and occurs automatically. Even though technically the process has the «init» process as its parent, it is still called an orphan process since the process which originally created it no longer exists.

Источник

How to Find and Kill a Zombie Process on Linux

A zombie is a creature that was a human and died but somehow due to a virus or any reason it woke up again. It is already dead but is walking and moving. This is the concept of a zombie described in movies and novels. In the same way in Linux, a zombie process is a process that was removed from the system as “defunct” but still somehow runs in the system memory is called zombie process. Until a child process is eliminated from a process table, it turns into a zombie first.

A process in the terminated state is another name for it. It is cleaned from the memory using its parent process. When the parent process is not notified of the change, the child process becomes the zombie process and it does not get any signal of termination so that it can leave the memory. In Linux, whenever a process is removed from the memory, its parent process is informed about the removal. This process stays in the memory until it notifies its parent process.

This means that the dead process is not removed from the memory immediately and it continues in the system memory thus becoming a zombie process. To remove a zombie process, the parent process calls the wait() function. Once the wait() function is called into play, the zombie process is completely removed from the system.

Killing a Zombie Process

Before moving to kill the zombie process, we will first discuss the zombie process risks and the causes of the zombie process taking place. Also, we will learn more about the zombie process to make it easy to understand the killing process.

What is the Cause of the Zombie Process

There can be two major causes of the zombie process. The first one is the one in which the parent process is unable to call the wait() function when the child creation process is running which leads to ignoring the SIGCHLD. This may cause the zombie process. The second is the one in which the other application may affect the parent process execution due to bad coding or malicious content in it.

In other words, we can say that the zombie process is caused when the parent process ignores the child process state changes or it cannot check the state of the child process, when the child process ends the PCB is not cleared.

Does the Zombie Process Pose a Risk

The zombie process does not pose any risk, they just use some part of memory in the system. The process table is of small size but the id of the table where the zombie process is stored cannot be used until it is released by the zombie process. But in case there are a lot of zombie processes reserving the memory location and no memory space left for other processes to take place, it becomes difficult for other processes to run.

Finding a Zombie Process

Before killing the zombie process it is necessary to find them. To find the zombie process we will run the following command in the terminal:

In the command above, “ps” stands for the process state it is used to view the state of the process that is running in the system along with the ps command. We passed the flag aux in which “a” indicates the details of all associated processes in the terminal, “u” indicates the processes that are in the user list and the “x” indicates the processes that are not executed from the terminal. In combination, we can say that it is used to print all of the running processes that are stored in the memory.

The second option passed “egrep” is a processing tool that is used to fetch the expressions or patterns in a specified location. Lastly, we passed the “Z|defunct” keyword which denotes the zombie process that is to be fetched in the memory. When we execute the command, we will get the following output, which shows the zombie process in the system along with its “PID”.

USER PID % CPU % MEM VSZ RSS TTY STAT START TIME COMMAND
linux 33819 0.0 0.0 18008 724 pts / 0 S+ 20 : 22 0 :00 grep -E —color =auto Z | defunct

Zombie processes are already dead processes but the parent process is unable to read its status and cannot be released from memory. So, the dead process cannot be killed. We can only do for them to enable the parent process to read the child state so it can be executed and removed from the process table. For this, we will run the command mentioned below.

In the above command, we tried to get the parent id of the zombie process. After getting the parent id, we will run the following command to kill the zombie process by sending the SIGCHLD to the parent process which enables the parent process to read the child state:

In the command above, we pass the signal to the parent id to kill the zombie process of the parent id passed to it. After the above command is executed, it will simply move to the next line without printing any output on the terminal in case no parent id exists. To check for the process whether the zombie process is killed or not, you can run the command that we already executed to find the zombie process.

Let us try another way to kill the zombie process which is done by killing the parent process itself. This is the more efficient way to kill the zombie process because it will completely remove the whole process and won’t allow the zombie to arise again. For that, we will run the below-shown command:

After running the above command, we allow the system to kill the parent process.

Conclusion

We have briefly discussed the zombie process and also the causes and the procedure to kill these processes. Before heading to our killing process, we tried to explain the reasons for their cause and also the ways to identify them using simple commands.

About the author

Kalsoom Bibi

Hello, I am a freelance writer and usually write for Linux and other technology related content

Источник

How to Find and Kill Zombie Process in Linux

Before you learn about Zombie process, let me recall what is a process in Linux.

In a few words, a process is a running instance of a program in performance. It can be foreground (interactive process) or background (not interactive or automatic process). It can be a parent (creator of other processes during run-time) or child (process created by others) process.

In Linux, except for the first init (or systemd) process with PID 0, every other process has a parent process. Processes also have their own child processes.

Don’t believe me? Use the pstree command in terminal to look at the process tree to see the ‘family tree’ of your system’s processes.

What is a Zombie process in Linux?

When a child process dies, the parent process is informed so that it can do some clean up like freeing up memory etc. However, child process goes into zombie state if the parent process is not aware of its death. For the parent, the child still exists but the child process is actually dead. This is how zombie processes (also known as defunct processes) are created and stay in the system.

Here’s an excellent funny take on the zombie process by Turnoff.us:

Do you really need to worry about Zombie processes?

Here is important to say that zombie processes are not as dangerous as its name can sound.

The problem may arise if your system has limited RAM or if there are too many zombie processes eating up RAM. Also, most Linux processes can have maximum PID set to 32768. If there are no available IDs for other productive tasks, your system may crash.

This rarely happens, but it’s a possibility, specially if a poorly coded program starts inducing numerous zombie processes.

In such case, it would be a good idea to find and kill zombie process.

How to find zombie processes?

A process in Linux can have one of the following states:

• D = uninterruptible sleep
• I = idle
• R = running
• S = sleeping
• T = stopped by job control signal
• t = stopped by debugger during trace
• Z = zombie

But where can you see the processes and their respective status? One easy way is to use the terminal and the top command.

As you can see in the screenshot above, there are 250 total tasks (or processes), 1 is running, 248 processes are sleeping and 1 is in zombie state.

Now, the question arises, how to kill the zombie process?

How to find and kill a zombie process? Can a zombie process be killed?

A zombie process is already dead. How do you kill an already dead process?

In the zombie movies, you shoot the zombies in the head or burn it. That’s not an option here. You can burn your system for killing the zombie process but that’s not a feasible solution 😉

Some people suggests sending SIGCHLD signal to the parent process. But it is more likely to be ignored. The other option to kill the zombie process is to kill its parent process. That sounds brutal but that’s the only sure shot way of killing zombie processes.

So, first, let’s list the zombie processes to know their ID. It can be achieved by using the ps command like this in the terminal.

The 8th column in the output of the ps aux command displays the state of a process. You are asking to print all the matching lines where the state of a process starts with Z or z.

Once you have identified its process ID, let’s get its parent’s process ID.

Alternatively, you can combine the above two commands in the following fashion where it directly provides the PID of the zombie process and the PID of its parent process.

ps -A -ostat,pid,ppid | grep -e '[zZ]'

Here you get the parent process ID, so finally kill the process by typing the command line with its respective ID process obtained before.

You can verify if the zombie process is killed or not by running the ps command again or even the top command.

Congrats! Now you know how to eliminate zombie processes.

With inputs from Abhishek Prakash.

Источник