A Zombie process, also referred to as a "defunct" or "dead" process, is a process that has completed its execution but remains present in the system's process table. It should have been removed from the table by its parent process, but for some reason this wasn't done correctly.
In a typical Linux system, when a process finishes its execution and exits, it sends a notification to its parent process. The parent process is then responsible for removing the process from the process table. However, if the parent process fails to read the status of the completed process, it can't remove it from memory and the process remains in the process table as a "dead" entity, referred to as a Zombie.
To eliminate a Zombie process, it must first be identified. The following command can be used for finding Zombie processes:
$ ps aux | egrep "Z|defunct"
A Zombie process can be identified by the letter "Z" in the STAT column and/or the word "[defunct]" in the last (COMMAND) column of the output.
Since a Zombie process is already dead, it can't be killed. Instead, its parent process must be notified to read the status of the dead process and remove it from the process table. This is done by sending a SIGCHLD signal to the parent process. The parent process ID (PID) can be found using the following command:
$ ps -o ppid= <Child PID>
Once the parent process ID of the Zombie is obtained, the following command can be used to send a SIGCHLD signal to the parent process:
$ kill -s SIGCHLD <Parent PID>
If sending a SIGCHLD signal to the parent process does not resolve the Zombie issue, the parent process must be killed or restarted. In case of a large increase in Zombie processes that are causing or leading to a system outage, a system reboot may be necessary. The following command can be used to kill the parent process:
$ kill -9 <Parent PID>
Keep in mind that killing a parent process will have an impact on all its child processes, so it's advisable to double-check before proceeding. If a few isolated Zombie processes are not using a significant amount of CPU or memory, it may be best to wait and kill the parent process or reboot the system during the next scheduled maintenance period.
No comments yet