How to kill or clean zombie or defunct processes in linux ?

Processes marked as are zombie(Z in ps command output) processes (also called as “dead” processes) that remain in process table memory because their parent has not destroyed them properly after their execution.

These processes are destroyed by init(8) once the parent process exits.

1. Viewing defunct processes

[root@nglinux ~]# ps -ef | grep -i defun
root      4295  4235  0 20:13 pts/4    00:00:00 ./defunct
root      4296  4295  0 20:13 pts/4    00:00:00 [defunct] 
root      4298  4271  0 20:13 pts/5    00:00:00 grep -i defun
[root@nglinux ~]# 


[root@nglinux ~]# ps aux | grep Z
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root      4009  0.0  0.1   5128  1292 ?        S    19:23   0:00 /bin/sh /etc/ati/authatieventsd.sh grant :0 /tmp/atievntX.E4wZag
root     27987  0.0  0.0      0     0 pts/4    Z+   21:23   0:00 [defunct] 

 

2. Re-read child process state.
We can try to send SIGCHLD signal to the parent process to let it try to re-read the child process status and clean them in case their execution is completed.

However this rarely works as the process was waiting due to sleep or wait call and not due to an error.

[root@nglinux ~]# ps -ef | grep -i defun
root     27986  4235  0 21:23 pts/4    00:00:00 ./defunct
root     27987 27986  0 21:23 pts/4    00:00:00 [defunct] 
root     28007  4271  0 21:26 pts/5    00:00:00 grep -i defun

### Try to send SIGCHLD signal to parent PID.
[root@nglinux ~]# kill -s SIGCHLD 27986

[root@nglinux ~]# ps -ef | grep -i defun
root     27986  4235  0 21:23 pts/4    00:00:00 ./defunct
root     27987 27986  0 21:23 pts/4    00:00:00 [defunct] 
root     28009  4271  0 21:27 pts/5    00:00:00 grep -i defun

 

3. Kill/Clean defunct process by killing/restarting the parent process.
We can’t kill a already killed/dead process, we can only wait for its parent process to clean it.

Or we can restart the parent process to clean it from process table.
Hence lets kill the parent process to clean the defunct process.

[root@nglinux ~]# ps -ef | grep -i defun
root     27949  4235  0 21:13 pts/4    00:00:00 ./defunct
root     27950 27949  0 21:13 pts/4    00:00:00 [defunct] 
root     27952  4271  0 21:13 pts/5    00:00:00 grep -i defun
[root@nglinux ~]# 

### Try to kill the process, it will not be killed.
[root@nglinux ~]# kill -9 27950
[root@nglinux ~]# ps -ef | grep -i defun
root     27949  4235  0 21:13 pts/4    00:00:00 ./defunct
root     27950 27949  0 21:13 pts/4    00:00:00 [defunct] 
root     27954  4271  0 21:13 pts/5    00:00:00 grep -i defun

### Now lets kill parent process, it will be killed.
[root@nglinux ~]# kill -9 27949
[root@nglinux ~]# ps -ef | grep -i defun
root     27956  4271  0 21:14 pts/5    00:00:00 grep -i defun
[root@nglinux ~]# 

However in this method there is a limitation, killing/restarting parent process will impact all child processes and can cause outage on the server.

In this case, you can keep the zombies running on as they are already completed processes and doesn’t consume more CPU/memory usage and restart the process id during maintenance window later.

Leave a Reply

avatar
  Subscribe  
Notify of