Skip to content

Killing Linux Zombie Processes

Tips
  • Periodically, when logging into any Linux based server, you may be met with the below

    32fbb04c-7cf3-4c4a-92df-7c62748f7d07-image.png

    In a typical Linux scenario, a process (or sub process) notifies its parent when it has completed its execution and has exited. The parent process should remove the process from process table. However, if the parent process is unable to read the process status from its child (the completing process or sub process), it won’t be able to remove the this from memory which causes the supposedly dead process to still continue to exist in the process table. The end result of this issue is a “zombie process” - one that has no reason to be running, and should have been terminated.

    Before you can terminate a process, you need to be able to identify it. Run the below in the terminal

    ps aux | egrep "Z|defunct"
    

    Here’s the result

    20274412-e1e1-4ddb-8a94-a659a649c21b-image.png

    Now, you can’t actually “kill” something that is already dead, but you can notify the parent process that it should check again to see if the sub or child process is still running or not

    ps -o ppid= <Child PID>
    

    As an example

    e4df563a-8b5d-4f27-b6db-dd7810fd0689-image.png

    This tells us that the process ID we need to target is 55496. Based on this, we then use

    kill -s SIGCHLD <Parent PID>
    

    49de9c15-e0d1-4077-bab0-801cc13a5c4e-image.png

    And with all the commands together

    5ccb9788-d260-483b-90eb-506ab28c4091-image.png

    Now run

    ps aux | egrep "Z|defunct"
    

    If you still see zombie processes, you’ll need to target the parent process. Please be aware that killing a parent process will automatically kill all child processes, so use with caution.

    21d7cfad-46e9-4638-89e0-32233d7168ad-image.png

    kill -9 <Parent PID>
    

    a4846b3f-fe78-43a2-8169-21e84c181735-image.png

  • @phenomlab

    I test to kill a zombie process on SSH

    ps -o ppid= <Child PID>
    

    the command does not return me any parent process

    167fb778-eb83-49e5-a5a5-45ce03e87504-image.png

    EDIT: Strange things

    When I log into SSH I see the zombie process message

    e26541d3-4fe6-4345-a0ac-aa8e8eb6dd27-image.png

    but not in top :

    3198cec2-e888-4542-9ca9-598803657d58-image.png

    And the zombie process number change with each order cli commands :

    593e5a88-b108-4f56-bf30-e2e4af9346c2-image.png

  • @DownPW odd indeed. Looks like it’s spawning, immediately dying, then spawning again.


Related Topics