Periodically, when logging into any Linux based server, you may be met with the below
In a typical Linux scenario, a process (or sub process) notifies its parent when it has completed its execution and has exited. The parent process should remove the process from process table. However, if the parent process is unable to read the process status from its child (the completing process or sub process), it won’t be able to remove the this from memory which causes the supposedly dead process to still continue to exist in the process table. The end result of this issue is a “zombie process” - one that has no reason to be running, and should have been terminated.
Before you can terminate a process, you need to be able to identify it. Run the below in the terminal
ps aux | egrep "Z|defunct"
Here’s the result
Now, you can’t actually “kill” something that is already dead, but you can notify the parent process that it should check again to see if the sub or child process is still running or not
ps -o ppid= <Child PID>
As an example
This tells us that the process ID we need to target is 55496. Based on this, we then use
kill -s SIGCHLD <Parent PID>
And with all the commands together
Now run
ps aux | egrep "Z|defunct"
If you still see zombie processes, you’ll need to target the parent process. Please be aware that killing a parent process will automatically kill all child processes, so use with caution.
kill -9 <Parent PID>
I test to kill a zombie process on SSH
ps -o ppid= <Child PID>
the command does not return me any parent process
EDIT: Strange things
When I log into SSH I see the zombie process message
but not in top :
And the zombie process number change with each order cli commands :
@DownPW odd indeed. Looks like it’s spawning, immediately dying, then spawning again.
