Skip to content

Killing Linux Zombie Processes

  • Periodically, when logging into any Linux based server, you may be met with the below


    In a typical Linux scenario, a process (or sub process) notifies its parent when it has completed its execution and has exited. The parent process should remove the process from process table. However, if the parent process is unable to read the process status from its child (the completing process or sub process), it won’t be able to remove the this from memory which causes the supposedly dead process to still continue to exist in the process table. The end result of this issue is a “zombie process” - one that has no reason to be running, and should have been terminated.

    Before you can terminate a process, you need to be able to identify it. Run the below in the terminal

    ps aux | egrep "Z|defunct"

    Here’s the result


    Now, you can’t actually “kill” something that is already dead, but you can notify the parent process that it should check again to see if the sub or child process is still running or not

    ps -o ppid= <Child PID>

    As an example


    This tells us that the process ID we need to target is 55496. Based on this, we then use

    kill -s SIGCHLD <Parent PID>


    And with all the commands together


    Now run

    ps aux | egrep "Z|defunct"

    If you still see zombie processes, you’ll need to target the parent process. Please be aware that killing a parent process will automatically kill all child processes, so use with caution.


    kill -9 <Parent PID>


  • @phenomlab

    I test to kill a zombie process on SSH

    ps -o ppid= <Child PID>

    the command does not return me any parent process


    EDIT: Strange things

    When I log into SSH I see the zombie process message


    but not in top :


    And the zombie process number change with each order cli commands :


  • @DownPW odd indeed. Looks like it’s spawning, immediately dying, then spawning again.