How to kill zombie processes in Linux

Posted on by

Let’s see how to kill zombie processes in Linux. But before that we have to explain what these processes are.

What is a zombie process?

Sometimes we are faced with Zombies, Defunct or orphan processes. Processes in Unix/Linux systems have a hierarchy, when a process creates other processes, these new processes are called child processes and the creator of the processes is the parent process. Normally, when everything works as expected, if the parent process dies, the children will die as well.

When we talk about Zombies, Defunct or Huerfano processes we are talking about child processes whose parents have died, in the eyes of the system it is assumed that they are dead too but when they are in the process list they are marked as Defunct. This rarely happens, and when it does we encounter problems caused by these processes such as processes that do not run correctly, slowness, etc.

Detecting zombie processes

Using the ps command we can detect zombie or orphan processes. To do this we execute the command:

ps -Al

For ejemple:

ger@DESKTOP-Q1D33PH:~$ ps -Al
F S UID PID PPID C PRI NI ADDR SZ WCHAN TTY TIME CMD
0 S 0 1 0 0 80 0 - 2235 ? ? 00:00:00 init
0 S 0 8 1 0 80 0 - 2235 - tty1 00:00:00 init
0 S 1000 9 8 0 80 0 - 4229 - tty1 00:00:01 bash
0 S 0 66 1 0 80 0 - 2235 - tty2 00:00:00 init
0 S 1000 67 66 0 80 0 - 4229 - tty2 00:00:01 bash
0 S 1000 401 9 0 80 0 - 4671 - tty1 00:00:00 ssh
0 R 1000 418 67 0 80 0 - 4274 - tty2 00:00:00 ps
ger@DESKTOP-Q1D33PH:~$

The pid column indicates its process ID. The ppid column indicates the ID of the parent process.

In the S column (which indicates the status) we can see the following values:

  • D- process waiting for some Input/Output operation to finish
  • R- running process
  • S- suspended process (waiting to be executed)
  • Z- zombie process

When a parent process dies and the child does not die, two things can happen:

  • If adopted by the parent process, the process with ID 1 becomes an orphan process.
  • If the above does not occur, it will be left without a parent process ID and will become a zombie or defunt.

Causes of this behavior

There are different causes that can lead to this behavior. Some of them are the following:

  • When the parent process is killed, the child has a hardware blockage, for example a storage that does not respond well.
  • There is a bug in the software that causes the process not to terminate on time.

How do we kill a zombie process?

Well, there are several ways, but sometimes, if the blocking is generated by reads and writes because it is a forgotten process in the system, it is possible that the fastest way is to reboot the system. Before we get to that point, let’s look at several ways to kill defunct processes:

The first way we can find is the most typical way to forcibly kill a process, that is, use:

kill -9 ID_DE_PROCESO

Massively eliminating zombies

If we want to massively remove zombie processes, we have the following options, in them we change the way of searching for the processes above all:

kill -9 `ps xawo state=,pid=|sed -n 's/Z //p'`

Another option is:

kill -9 `ps -xaw -o state -o ppid | grep Z | grep -v PID | awk '{print $2}'`

A third option is:

ps -Ao state,pid | awk '$1=="2" {print $2}' | xargs kill -s SIGKILL

A fourth option is:

ps -xaw -o state,ppid | grep Z | grep -v PID | awk '{ print $2 }' | xargs kill -9

Finally we have this last command, which varies in the execution of the way of sending HUP signals to the zombie processes:

kill -HUP `ps -A -ostat,ppid,pid,cmd | grep -e '^[Zz]' | awk '{print $2}'`

It is possible that none of the above commands will terminate the zombie process, if so, unfortunately, the system will have to be restarted.

 

 

Leave a Reply