Linux – detecting zombie processes

Add the l option to your ps command line. This is the option for long output. The parent process id is one of the additional columns -- labeled PPID.

$ ps l
F   UID   PID  PPID PRI  NI    VSZ   RSS WCHAN  STAT TTY        TIME COMMAND
0   508  3344  4498  18   0   2452  1236 wait   Ss   pts/12     0:00 /bin/sh
0   508  4467 17796  15   0   4664  1572 wait   Ss   pts/5      0:00 -/bin/bash
0   508  4498  4467  15   0  23032 15108 -      S+   pts/5      2:20 emacs -nw
0   508  4532 17796  15   0   4532  1464 wait   Ss   pts/13     0:00 -/bin/bash
0   508  4916 17796  15   0   4664  1648 wait   Ss   pts/7      0:01 -/bin/bash

Another option is the pstree command to show an ascii tree representation of the processes. You'll probably want the -p option to show process ids.

$ pstree -p dharris
screen(17796)─┬─bash(4467)───emacs(4498)───sh(3344)───sh(3345)
              ├─bash(4532)───su(31037)───bash(31041)
              ├─bash(4916)───pstree(26456)
              ├─bash(13547)───su(20442)───bash(20443)
              └─bash(17797)

sshd(25813)───bash(25817)───screen(25870)

No. killall first lists all processes that are to be killed, and then iterates through that list and kills them. If you have a forkbomb running, after killall will kill one of its processes, it is very likely that another process will immediately reclaim PID which has just freed, but killall thinks it already killed that process, so effectively nothing will happen.

You should use ulimit if a forkbomb is a problem for you. Limit number of processes to, for example, 128, and a forkbomb will silently die or stop expanding, depending on how it was written. Anyway, it will not present any danger to other users of that system.