Everything you need to know about the zombie process

Understand what is zombie process in Linux Unix, how the process goes to a zombie state, how to handle the zombie process, what is the impact of zombie processes.

In very lame terms, the Zombie process is a process that is present in the process table even if it’s already dead! The zombie process is also known as a defunct process. To understand how the zombie process gets created let see how to process exiting takes place from memory.

How the zombie gets created

Whenever the process completes its execution, it exits and notifies its parent process that his child has died. At this time, the parent process supposes to execute the WAIT system call which reads dead child process status and other details. Once the wait system call completes, a dead child will be removed from memory. At this point, if the parent process is not coded properly or unable to read this status from a child for some reason then it won’t fork wait system call. This in turn keeps the dead child process in memory & process table.

This whole operation completes very fast. Zombie takes a very tiny amount of memory to live in so a couple of zombies on the server are harmless. Many zombie processes have parent PID as 1 which is the init process. When a child is dead but not cleared from memory and parent process exists then those child zombies will be taken over by init. Init usually runs its child zombie clearance periodically. So its possible those zombies get cleared out in it.

How to check the zombie process

You can list zombie processes on your server with below command :

# ps aux |grep Z
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root     16479  0.0  0.0 103304   812 pts/0    S+   10:44   0:00 grep Z
oracle9  14523  0.0  0.0  52367   702 pts/1    Z    09:15   1:00 asldjkeh

In the above output watch out for STAT column. Z indicates the zombie process. Even top command shows a total number of zombie processes on the system. Check highlighted field in yellow :

You can get parent PID of the zombie process using ps or pstree command.

How to kill the zombie process

You simply can’t! Because of its Zombie! It’s already dead! The maximum you can do is to inform its parent process that its child is dead and now you can initiate a wait system call. This can be achieved by sending SIGCHLD a signal to parent PID using below command :

# kill -s SIGCHLD <ppid>

Here, ppid is the parent process id.

Impact of the zombie process on the system

As we already discussed, a couple of zombie processes are harmless. But if they are growing rapidly then there are two areas which may be bottlenecked and your system prone to panic :

1. Each zombie holds its PID hence rapidly growing zombies can exhaust all available PIDs on the system and then no new process can be forked by the kernel.
2. Even zombie holds a very tiny amount of memory, huge numbers can make a difference. A large number of zombies can hog a considerable amount of memory contributing to high memory utilization of the machine.

If your system is flooded with zombies that are not being cleared even by init, system reboot can be tried for a quick refresh. Obviously this would be the last resort you should be looking at.