Walker News

How To Find And Kill Zombie Process On Linux System?

A zombie process (a.k.a. defunct process) is a process that has ended execution but left in the process table of Linux operating system. So, how to handle or terminate zombie process on Linux system?

Suppose the parent process that started it has executed wait system call to read its child process exit status, there will be no such defunct process left in the process table.

As the process terminated, the memory or system resources used during its execution are freed or released to operating system. Therefore, zombie process consumes very little system resource, except when the number of defunct process increases tremendously until overload process table.

How to find out or check the number of zombie process on Linux system? The following commands can help (reference is based on Redhat Linux, RHEL 5 to be precise).

To check zombie / defunct process existence:
ps -elf | awk '{print $2" "$4" "$5}' | grep ^Z

where the output of first column indicates status of process, second column denotes process ID (PID) and third column is parent process ID (PPID).

Alternative, grep the “defunct” keyword, i.e.:
ps -elf | grep defunct

To find out the number of these defunct processes (assuming the previous command returns a long list), simply include “wc” command. E.g. either one of these two commands will do:
ps -elf | awk '{print $2}' | grep ^Z | wc -l
ps -elf | grep defunct |grep -v grep | wc -l

How to terminate zombie / defunct Linux process?

Remember the definition of zombie process? It is a process that has stopped execution except its entry in process table of Linux operating system (and thus consuming little system resources, if the number of such process is small).

Therefore, you hardly can terminate defunct process by using “kill -9” command. You might able to remove the zombie process by:
  1. Restart or terminate its parent process that spawn it.
  2. Manually sending SIGCHLD signal to parent process (advised by expert by never work for my cases):
    kill -s SIGCHLD ppid

    where ppid is the parent process ID of the defunct process.
  3. Reboot the Linux system, if the number of zombie process grows up to a harmful level (i.e. causes system performance and reliability to degrade).

If possible, talk to programmers who develop the parent process and find out from them is that designed by purpose (e.g. to avoid new child process reuse process ID taken by terminated child process and thus becomes defunct) or it is actually a bug that can be fixed.

Custom Search

2016  •  Privacy Policy