How to find and Kill all ‘Zombie processes’ running on server? ~ AwsTechNix

Did you ever notice some processes with status “Z” on your server/system? 

 

These are Zombies. On this article I’m explaining the ways to find and kill all Zombies on the server.

A process is called a zombie process if the process has been completed, but its PID and process entry remains in the Linux process table. A process is removed from the process table when the process is completed, and its parent process reads the completed process' exit status by using the wait() system call. If a parent process fails to call wait() for whatever reason, its child process will be left in the process table, becoming a zombie. It almost always means that the parent is still around. If the parent exited, the child would be orphaned and re-parented to init, which would immediately perform the wait. In other words, they should go away once the parent process is done.

A zombie process doesn’t react to signals.

1. How can I get the Zombies from process list?

Its very simple! You can find out the Zombie processes in different ways:

# ps aux |grep "defunct"

khim  3366  0.0  0.0    0     0 ?        Z    07:34   0:00 [chrome] defunct 

khim  3435  0.0  0.0    0     0 ?        Z    07:44   0:19 [chrome] defunct 

khim  3722  0.0  0.0    0     0 ?        Z    08:21   0:00 [pidgin] defunct 

khim  4287  0.1  0.0    0     0 ?        Z    09:26   0:38 [chrome] defunct 

khim  5378  0.1  0.0    0     0 ?        Z    11:24   0:15 [chrome] defunct

# ps aux |grep Z

USER PID %CPU %MEM  VSZ   RSS TTY  STAT START   TIME   COMMAND

khim  3366     0.0     0.0        0        0       ?        Z     07:34     0:00      [chrome] 

khim   3435    0.0     0.0        0        0       ?        Z     07:44     0:19      [chrome]
khim   3722    0.0     0.0        0        0       ?        Z     08:21     0:00      [pidgin] 

khim   4287    0.1     0.0        0        0       ?        Z     09:26     0:38      [chrome]
khim   5378    0.1     0.0        0        0       ?        Z     11:24     0:15      [chrome]

2. How many Zombie processes running on your server? Juz count it out!

This is just to make a count of Zombie processes on the server. It can be done in different ways.

Please see some examples.

# ps aux | awk {'print $8'} | grep -c Z
5

# ps aux | awk '{ print $8 " " $2 }' | grep -wc Z
5

# ps aux | awk {'print $8'} | grep Z | wc -l
5

 

3. List the PID of Zombie?

# ps aux | awk '{ print $8 " " $2 }' | grep -w Z
Z 3366
Z 3435
Z 3722
Z 4287
Z 5378

In order to kill these processes, you need to find the parent process first.

# pstree -paul

See the sample output:

[root@vps ~]# pstree -paul
init,1
  |-crond,542
  |-dovecot,6576
  |   |-anvil,6577,dovecot
  |   |-config,25099
  |   `-log,6578
  |-httpd,5047
  |   |-httpd,1900,apache
  |   |-httpd,9428,apache
  |   |   |-php-cgi,1904,ctalk
  |   |   |-php-cgi,11989,ctalk
  |   |   `-php-cgi,11994,ctalk
  |   |-httpd,19203,apache
  |   |-httpd,22975,apache
  |   |-httpd,25197,apache
  |   `-httpd,30417,apache
  |-(kthreadd/3929,2)
  |   `-(khelper/3929,3)
  |-master,5227
........

This will show the pid of the of the parent of the zombie process. Now you need to kill the parent process or restart the service.

4. To find zombie processes with PPID(Parent PID) on Linux:

 

# ps axo stat,ppid,pid,comm | grep -w defunct 

Z    27698   3366 chrome <defunct>
Z    27698   3435 chrome <defunct>
Z    27758   3722 pidgin <defunct>
Z    27698   4287 chrome <defunct>
Z    27698   5378 chrome <defunct> 

The above command searches for processes with zombie (defunct) state, and displays them in (state, PPID, PID, command-name) format. The sample output shows that there is two zombie processes associated with "chrome & pidgin", and these were spawned by parent process with PIDs 27698 & 27758 respectively.

Killing zombie processes is not obvious since zombie processes are already dead. You can try two options to kill a zombie process on Linux as follows.

First, you can try sending SIGCHLD signal to the zombie's parent process using the kill command. Note that the above command gives you PPID (PID of parent process) of each zombie. In our example, PPID of the zombie are 27698 & 27758.

# sudo kill -s SIGCHLD 27698

# sudo kill -s SIGCHLD 27758

If a zombie process still does not go away, you can kill the parent process (e.g., 27698 or 27758) of the zombie.

# sudo kill -9 27698

# sudo kill -9 27758

Once its parent process gets killed, the zombie will be adopted by the init process, which is a parent of all processes in Linux. The init process periodically calls wait() to reap any zombie process.

That’s it! Try this and let me know if you’ve any questions. 😄