Pages

Friday, March 4, 2011

What is Zombie process in Linux?

Zombie process    

                                      On Unix and Unix-like computer operating systems, a zombie process or defunct process is a process that has completed execution but still has an entry in the process table. This entry is still needed to allow the process that started the (now zombie) process to read its exit status. The term zombie process derives from the common definition of zombie—an undead person. In the term's metaphor, the child process has "died" but has not yet been "reaped". Also, unlike normal processes, the kill command has no effect on a zombie process.

Finding if zombies exist

  • execute the top command
  • one line is tasks:
    • Example output:
      Tasks: 139 total,   2 running, 136 sleeping,   0 stopped,   1 zombie

Who is zombie

  • execute: ps aux | awk '{ print $8 " " $2 }' | grep -w Z
    • example output:
    • [root@server2~]#ps aux | awk '{print $8 " " $2}' | grep -w Z
      Z
      5245 

    Kill the zombies

    zombies are living dead, so the aren't always easy to kill.
    • Try executing: kill -9 PID 
    • [root@server2~]#kill -9 5245
      [root@server2~]#ps aux | awk '{print $8 " " $2}' | grep -w Z
      Z 5245
    • If its still undead
      • get a cross or garlic, well reliable sources tell me the don't work. We must try something else
    • Kill the zombie's parent (process)
    • execute: ps efx
      • this will display a process (family) tree
      • find the command who is the PID matches the zombie then look at the parents and try killing them
    • example:
      5191 tty7     Ss+    0:14      \_ /usr/bin/Xorg :0 -br -audit 0 -aut /var/gdm/:0.Xauth -nolisten tcp vt7 bckclr=tput setb 7 HOSTNAME=server


    5213 ?        Ss     0:00                  \_ /usr/bin/gnome-session bckclr=tput setb 7  SSH_AGENT_PID=5253 HOSTNAME=server2 SHELL=/bin/bash TERM=dumb HI
     5245 ?        Z      0:00                         \_ [Xsession]
        
    • Xsession matches the PID above, 5245 
    • so in this example I would try killing
            5213 pts/1 Sl+ 1:29 /usr/bin/gnome-session
            5191 tty1 S 0:00 xterm -e /usr/bin/Xorg

    • Hopefully this will work 

    Kuldeep Sharma
    !Enjoy