Everything you need to know about zombie process

In very lame terms, Zombie process is a process which is present in process table even if its already dead! Zombie process also known as defunct process. To understand how zombie process gets created let see how process exiting takes place from memory.

How zombie gets created:

Whenever process completes its execution, it exits and notify its parent process that his child has died. At this time, parent process suppose to execute WAIT system call which reads dead child process status and other details. Once wait system call completes, dead child will be removed from memory. At this point, if parent process is not coded properly or unable to read this status from child for some reason then it wont fork wait system call. This in turns keeps dead child in memory & process table.

This whole operation completes very fast. Zombie takes very tiny amount of memory to live in so couple of zombies on server are harmless. Many zombie processes have parent PID as 1 which is init process. When child is dead but not cleared from memory and parent process exists then those child zombies will be taken over by init. Init usually runs its child zombie clearance periodically. So its possible those zombies gets cleared out in it.

How to check zombie process:

You can list zombie processes on your server with below command :

Shell

1

2

3

4

5

6

# ps aux |grep Z

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND

root     16479  0.0  0.0 103304   812 pts/0    S+   10:44   0:00 grep Z

oracle9  14523  0.0  0.0  52367   702 pts/1    Z    09:15   1:00 asldjkeh

In above output watch out for STAT column. Z indicates zombie process. Even top command shows total number of zombie processes on system. Check highlighted field in yellow :

You can get parent PID of zombie process using ps or pstree command.

How to kill zombie process:

You simple cant! Because its Zombie! Its already dead! Maximum you can do is to inform its parent process that its child is dead and now you can initiate wait system call. This can be achieved by sending SIGCHLD signal to parent PID using below command :

Shell

1

2

3

# kill -s SIGCHLD <ppid>

Here, ppid is parent process id.

Impact of zombie process on system:

As we already discussed, couple of zombie processes are harmless. But if they are growing rapidly then there are two areas which may be bottle necked and your system prone to panic :

Each zombie holds its PID hence rapidly growing zombies can exhaust all available PIDs on system and then no new process can be forked by kernel.
Even zombie holds very tiny amount of memory, huge numbers can make difference. Large number of zombies can hog considerable amount of memory contributing to high memory utilization of machine.

If your system is flooded with zombies which are not being cleared even by init, system reboot can be tried for quick refresh. Obviously this would be the last resort you should be looking at.