Killing Linux Zombie Processes

[phenomlab]

Periodically, when logging into any Linux based server, you may be met with the below

In a typical Linux scenario, a process (or sub process) notifies its parent when it has completed its execution and has exited. The parent process should remove the process from process table. However, if the parent process is unable to read the process status from its child (the completing process or sub process), it won’t be able to remove the this from memory which causes the supposedly dead process to still continue to exist in the process table. The end result of this issue is a “zombie process” - one that has no reason to be running, and should have been terminated.

Before you can terminate a process, you need to be able to identify it. Run the below in the terminal

ps aux | egrep "Z|defunct"

Here’s the result

Now, you can’t actually “kill” something that is already dead, but you can notify the parent process that it should check again to see if the sub or child process is still running or not

ps -o ppid= <Child PID>

As an example

This tells us that the process ID we need to target is 55496. Based on this, we then use

kill -s SIGCHLD <Parent PID>

And with all the commands together

Now run

ps aux | egrep "Z|defunct"

If you still see zombie processes, you’ll need to target the parent process. Please be aware that killing a parent process will automatically kill all child processes, so use with caution.

kill -9 <Parent PID>

[DownPW]

@phenomlab

I test to kill a zombie process on SSH

ps -o ppid= <Child PID>

the command does not return me any parent process

EDIT: Strange things

When I log into SSH I see the zombie process message

but not in top :

And the zombie process number change with each order cli commands :

[phenomlab]

@DownPW odd indeed. Looks like it’s spawning, immediately dying, then spawning again.