Undead and Open Source: Zombie Processes in Linux Explained

It's possible to end any Linux process using the "kill" command or by using your desktop's process monitor. In particular, the "kill -9" command instantly terminates any specified process without giving it a chance to save its data properly and exit.

So, if any process can be killed, why can't a zombie process be killed? In short, zombie processes are already dead, hence the name. Zombie processes aren't really processes at all. Zombie processes are the leftover bits of dead processes that haven't been cleaned up properly by their parent process. A zombie process on a computer isn't a problem, takes up very little resources and can be ignored. However, if you have many zombie processes, this could indicate a software bug.

When a subprocess exits, its parent is supposed to use the "wait" system call and collect the process's exit information. The subprocess exists as a zombie process until this happens, which is usually immediately. However, if the parent process isn't programmed properly or has a bug and never calls "wait," the zombie process remains, eternally waiting for its information to be collected by its parent.

Zombie processes persist until their parent process ends, at which point they are adopted by the "init" system process and shortly cleaned up. However, there's no way to get rid of a zombie process without ending its parent process. If you have a lot of zombie processes, close and restart the parent process or service. Init adopts and cleans up the orphaned zombie processes.

If you can't close the parent process, don't worry, zombies won't affect the performance of your computer unless a very large amount are present. However, bear in mind that, if a process is creating a lot of zombies, it has a programming bug or error in its code and isn't working correctly.

click to enlarge

You can also list running processes by executing the "ps aux" command. Zombie processes have a "z" listed in their Stat column in the output of the 'ps aux" command.

While zombie processes aren't a problem in and of themselves and take up very little resources, there is one concern. Linux systems have a maximum amount of processes and thus process ID numbers. If a computer has enough zombie processes, the maximum amount is reached and new processes can't be launched.

The maximum amount of processes can be listed by typing the "cat /proc/sys/kernel/pid_max" in a Terminal window and is usually 32768. Thus, zombie processes are usually not a concern.

However, if the parent process creating zombie processes is server software that isn't written properly, a large amount of zombies could be created under load. Or, zombies could gradually accumulate over long periods of time until the maximum process limit is reached. A few zombies are nothing to worry about, but if you need to kill a lot of zombie processes, your software needs to be fixed.