Linux 101: What are zombie processes?

When you think of zombies, your mind probably travels a rather Romero-ian path. Shambling ghouls who want nothing more than to crack open your skull and dine on your thought-meat.

But within the realm of Linux, zombies are a different creature altogether. Sort of.

SEE: 5 Linux server distributions you should be using (TechRepublic Premium)

Open source: Must-read coverage

• Debian vs Ubuntu: Which Linux Distro Fits Your Needs Best?
• Ubuntu Server: A Cheat Sheet
• Llama 3 Cheat Sheet: A Complete Guide for 2024
• CISA Report Finds Most Open-Source Projects Contain Memory-Unsafe Code

On the Linux platform, a zombie is a remaining bit of a dead process that wasn’t or hasn’t been properly cleaned up. A zombie is created by programs that crash or weren’t adequately coded to handle the cleanup of a crash or exit.

Technically speaking, when a process dies, the process descriptor remains in memory and becomes labeled EXIT_ZOMBIE. At this point, the parent process is notified that the child process has died with the SIGCHLD signal and the parent is supposed to execute the wait system call, which allows the parent to collect information from the now-dead process. This generally happens almost immediately. But not always.

If a parent process isn’t coded correctly, it might not issue the wait system call, and the zombie will stick around in memory. This usually isn’t a problem. But if too many zombie processes collect, it can cause issues with your system. The biggest issue is that those zombies use up process IDs which could prevent other processes from running.

SEE: How-to guide for Linux administrators (free PDF) (TechRepublic)

If too many process IDs have been consumed by zombies, how do you list zombie processes? Easy.

Issue the command ps aux | grep ‘Z’ and if any zombie processes are hanging around, you should see them. Those zombie processes will be listed with an associated Process ID.

To kill a zombie process, you can send the SIGCHLD signal with the command kill -s SIGCHLD PID (Where PID is the process ID of the zombied process).

Typically, you shouldn’t see any zombie processes on your system. But if your system is behaving oddly (not as in trying to chomp your brains), check for zombie processes and, if you find any, kill them immediately.