Ubuntu – How to find zombie process

processzombie

System information as of Fri Mar  9 19:40:01 KST 2012

  System load:    0.59               Processes:           167
  Usage of /home: 23.0% of 11.00GB   Users logged in:     1
  Swap usage:     0%                 IP address for eth1: 192.168.0.1

  => There is 1 zombie process.

  Graph this data and manage this system at https://landscape.canonical.com/

10 packages can be updated.
4 updates are security updates.

Last login: Fri Mar  9 10:23:48 2012
a@SERVER:~$ ps auxwww | grep 'Z'
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
usera     13572  0.0  0.0   7628   992 pts/2    S+   19:40   0:00 grep --color=auto Z
a@SERVER:~$

How to find that zombie process?

Best Answer

To kill a zombie (process) you have to kill its parent process (just like real zombies!), but the question was how to find it.

Find the zombie (The question answered this part):

a@SERVER:~$ ps aux | grep 'Z'

What you get is Zombies and anything else with a Z in it, so you will also get the grep:

USER       PID     %CPU %MEM  VSZ    RSS TTY      STAT START   TIME COMMAND
usera      13572   0.0  0.0   7628   992 pts/2    S+   19:40   0:00 grep --color=auto Z
usera      93572   0.0  0.0   0      0   ??       Z    19:40   0:00 something

Find the zombie's parent:

a@SERVER:~$ pstree -p -s 93572

Will give you:

init(1)---cnid_metad(1311)---cnid_dbd(5145)

In this case you do not want to kill that parent process and you should be quite happy with one zombie, but killing the immediate parent process 5145 should get rid of it.

Additional resources on askubuntu:

Related Solutions

Ubuntu – ny way to kill a zombie process without reboot

I don't thing zombie process is much of a headache. A zombie process does not take up any resources. It is just that it has it's entry in the process table.

A Zombie process is not an orphan process, it does have a parent.

kill, skill pkill will not work since the process is already killed, just that it's entry has not been removed.

Zombie process can be killed by sending SIGCHLD signal to parent. I think the signal number of SIGCHLD is 17 or 18

If this also fails, then you might want to kill the parent itself.

From Wikipedia on SIGCHLD signal:

When a child process terminates before the parent has called wait, the kernel retains some information about the process to enable its parent to call wait later. Because the child is still consuming system resources but not executing it is known as a zombie process.

EDIT 1: The system resources consumed is mostly the process table entry. If anyone knows if it consumes more than that - memory or CPU cycle, then please add an explanation. AFAIK it hardly takes up any significant system resources.

EDIT 2: Quoting from Wikipedia

On Unix and Unix-like computer operating systems, a zombie process or defunct process is a process that has completed execution but still has an entry in the process table. This entry is still needed to allow the process that started the (now zombie) process to read its exit status.

So the entry is kept so that the parent process can know the exit status because the moment the child exits, the parent is probably not in a state or not ready to read it's exit status.

EDIT 3

Till date I never experienced a zombie process taking 100% of the CPU. Seeing this for the first time.

Try doing a killall utorrent.exe

I can see that there are two instances of utorrent.exe and one of them is zombie. Probably the second one (child). killall should kill the parent since the child(zombie) cannot be killed.

EDIT 4

Looks like the killall did not work since it was giving TERM signal instead of KILL.

Try out killall --signal=KILL utorrent.exe

If this does not work then try killing the process selectivly.

Get the list of utorrent.exe process PID

ps -e | grep -i utorrent

You should get two process like

xxxx ?        aa:bb:cc utorrent.exe defunct
yyyy ?        aa:bb:cc utorrent.exe

So the second one is the parent. Kill it using

kill -9 yyyy

EDIT 5

Please try finding the process's Parent Id by this bash command

cat /proc/{defunctpid}/status | grep -i ppid

in your case is

cat /proc/7298/status | grep -i ppid

If the output comes like

PPid: 1

Then sadly I think you are out of luck. Process Id 1 belongs to init without which your system cannot run

Ubuntu – What are zombie processes

Zombies are DEAD processes. They can not be 'kill' (You cannot kill the DEAD). All processes eventually die, and when they do they become zombies. They consume almost no resources, which is to be expected because they are dead! The reason for zombies is so the zombie's parent (process) can retrieve the zombie's exit status and resource usage statistics. The parent signals the operating system that it no longer needs the zombie by using one of the wait() system calls.

When a process dies, its child processes all become children of process number 1, which is the init process. Init is ``always'' waiting for children to die, so that they don't remain as zombies.

If you have zombie processes it means those zombies have not been waited for by their parent (look at PPID displayed by ps -l). You have three choices: Fix the parent process (make it wait); kill the parent; or live with it. Remember that living with it is not so hard because zombies take up little more than one extra line in the output of ps.

Zombies can be identified in the output from the Unix ps command by the presence of a "Z" in the STAT column. Zombies that exist for more than a short period of time typically indicate a bug in the parent program. As with other leaks, the presence of a few zombies isn't worrisome in itself, but may indicate a problem that would grow serious under heavier loads.

To remove zombies from a system, the SIGCHLD signal can be sent to the parent manually, using the kill command. If the parent process still refuses to reap the zombie, the next step would be to remove the parent process. When a process loses its parent, init becomes its new parent. Init periodically executes the wait system call to reap any zombies with init as parent.

There are also orphan processes which are a computer process whose parent process has finished or terminated.

A process can become orphaned during remote invocation when the client process crashes after making a request of the server.

Orphans waste server resources and can potentially leave a server in trouble (This is the biggest resource difference between zombies and orphans (Except if you see some orphan zombie movie). However there are several solutions to the orphan process problem:

Extermination is the most commonly used technique; in this case the orphan process is killed.
Reincarnation is a technique in which machines periodically try to locate the parents of any remote computations; at which point orphaned processes are killed.
Expiration is a technique where each process is allotted a certain amount of time to finish before being killed. If need be a process may "ask" for more time to finish before the allotted time expires.

A process can also be orphaned running on the same machine as its parent process. In a UNIX-like operating system any orphaned process will be immediately adopted by the special "init" system process. This operation is called re-parenting and occurs automatically. Even though technically the process has the "init" process as its parent, it is still called an orphan process since the process which originally created it no longer exists.

More Info:

http://wiki.answers.com/Q/What_is_Zombie_Process_and_Orphan_Process#ixzz1PCN9vojU

http://www.linuxsa.org.au/tips/zombies.html

http://www.brighthub.com/computing/linux/articles/79186.aspx

How to identify and kill hanging process, when system hangs and reacts slowly on user input?

Killing a running process in an Ubuntu machine remotely from a windows machine which is in LAN

Best Answer

Related Solutions

Ubuntu – ny way to kill a zombie process without reboot

Ubuntu – What are zombie processes

Related Question