What is a zombie?

A zombie process is simply a process that has exited but its parent has not yet read the processes exit code. Since the process has exited it does not have any open files or uses any memory in fact the only resources it is using is a entry in the task list. So in most Linux systems will mean that it is using around 4k-8k of memory.

Until the parent process reads the exit code the zombie will exist. Typically this points to a software bug in the parent process or an issue that caused the child (which is now the zombie) to exit unexpectedly. Which would also point to
a bug or issue in the program. In either case the parent process should have actually dealt with the error an acted on it to read the exit status of the process which will clean up the zombie process and allow it to exit.

Why is there any issue?

Since the program isn't really using any resources it really doesn't cause any issues. However if you have a lot of zombie's being generated inside a system due to a bug in the software it will cause an issue because it is still running
as a process and sooner or later you will hit the limit of the maximum number of processes permitted to run in the system. If this limit is reached you will not be able to start any more processes. This means you won't be able to run commands from the command line any more.

Why does kill now work on the zombie process?

Kill simply does not work on a zombie process since it is in fact already "dead"

How to kill it?

Since the issue really exists in the parent process the solution is to remove the parent process either by killing it or shutting it down. This will cause the child "zombie" processes to get a new parent process which will be the parent of the parent.

If you are working in a complex system you may need to kill several parent process in order to eliminate the zombies until the zombies get a parent process that will read the exit code from the processes which will cause the zombie process to be remove.

Hint: if you use the command "ps axfu" the "f" in the argument list will print the output as a tree which will make finding the parent somewhat easier.

Last Modified: 18 February 2017

Releated Posts

2013-03-01 - Linux - What and how to kill a zombie process
2013-02-14 - Linux - Getting sshfs to work
2012-12-12 - Linux - List / Copy group membership for users
2012-12-08 - Linux - ssh key authentication
2012-12-04 - Linux - sudo without a password
2012-10-13 - Rasberry Pi - Alternative method to play video without omx gstreamer element
2012-10-10 - How to run tcpdump as root
2012-07-13 - Linux - Killing all processes for a specific user
2012-04-05 - Using gdb to debug a core file
2012-01-16 - Linux - Color Coding The Bash Prompt
2012-01-14 - Linux - Automatically set the DISPLAY environment variable in SSH connection
2012-01-06 - Adding extra swap space to linux