Walker News

Linux: Orphan Process vs Zombie or Defunct Process

On Linux system, an orphan process is not a zombie / defunct process – there are differences between these two categories. You may, however, call the orphan process as runaway process.

What is Linux orphan process?

Unlike zombie process, an orphan process not only appears in the operating system process table, it also continues occupy memory spaces and system resources because the orphan process is still in execution state!

A Linux process is categorized as orphan process when the parent process that started it crashed or terminated unexpectedly and thus causes its child process re-parent to init process (a daemon process typically taking PID 1) to continue its execution state!

Therefore, you can spot them by using this command:
ps -elf | awk '{if ($5 == 1){print $4" "$5" "$15}}'

NOTE: The above command definitely returns a long list of processes with parent process ID 1, because there are many daemon processes or services (e.g. sshd, smartd, etc) actually started by init (the super process of Linux). That command output only helps Linux administrator (or experience users) to identify (spot) processes that are known not supposed to be started by the init process – otherwise, those are considered orphan processes (runaway process), as a result re-parenting operation.

Since orphan process consuming system resources, it should be terminated if possible, i.e. execute kill -9 pid to kill the runaway process.

It is easier to handle or terminate orphan process as compare to defunct process, isn’t it?

Custom Search

2018  •  Privacy Policy