Linux – How to Find the Parent Process of a Zombie Process

Generally speaking, when a process becomes orphan (that is, its parent dies) it is adopted by init.

The special situation you describe probably applies to an interactive process when its controlling terminal closes (from Wikipedia):

The SIGHUP signal is sent to a process when its controlling terminal is closed. It was originally designed to notify the process of a serial line drop. In modern systems, this signal usually means that controlling pseudo or virtual terminal has been closed.

To prevent this, child processes should block SIGHUP, so in most cases you need cooperation from the parent process.

If the parent process is a shell (bash, csh and the like) and you want commands you run not to terminate when bash finishes, you can prefix any command with nohup (from info coreutils "nohup invocation"):

'nohup' runs the given COMMAND with hangup signals ignored, so that the command can continue running in the background after you log out.

In this example:

$ tty
/dev/ttys000
$ nohup find /dir -name file -exec rm {} \;

find won't be killed when the shell terminates and closes the controlling terminal /dev/ttys000.

If a shell script should block SIGHUP, use the builtin trap, as explained here for bash.

I am not sure how to do it from command line, but I wrote this to do some filtering of OS related processes from PowerShell. Maybe it will give you an idea. It skips items owned by service, system and null.

gwmi win32_process |select ProcessID,ParentProcessID,Name, @{l="Username";e={$_.getowner().user}}|where {$_.Username -ne "SYSTEM"} | where {$_.Username -ne "LOCAL SERVICE"} | where {$_.Username -ne "NETWORK SERVICE"} | where {$_.Username -ne $null} |Sort-Object ProcessID | ft -AutoSize
#

Output

    ProcessID ParentProcessID Name            Username
    --------- --------------- ----            --------
     2136     3460            notepad.exe     KNUCKLE-DRAGGER
     2504     3460            firefox.exe     KNUCKLE-DRAGGER
     2792      700            dllhost.exe     KNUCKLE-DRAGGER
     2816     4232            conhost.exe     KNUCKLE-DRAGGER
     2916     3460            powershell.exe  KNUCKLE-DRAGGER
     3128     3460            notepad.exe     KNUCKLE-DRAGGER
     3180      576            taskhost.exe    KNUCKLE-DRAGGER
     3196     4308            vmware-tray.exe KNUCKLE-DRAGGER
     3460     4392            explorer.exe    KNUCKLE-DRAGGER
     3644     4636            vmware-vmx.exe  KNUCKLE-DRAGGER
     3696     3460            mplayerc.exe    KNUCKLE-DRAGGER
     4636     3196            vmware.exe      KNUCKLE-DRAGGER
     4828     3460            notepad.exe     KNUCKLE-DRAGGER