Zombie Process

Posted on by user

In Linux and other Unix-like operating systems, a “zombie” process, or defunct process, is a process that has completed execution but still has an entry in the process table. This occurs when a process has finished running, but its parent process has not yet read its exit status. Here’s a bit more detail:

Characteristics of a Zombie Process

  1. Completed Execution: A zombie process is one that has finished its execution, typically by calling exit() or after receiving a signal.
  2. Exit Status: When a process ends, it returns an exit status to its parent process. This status contains information about whether the process completed successfully or if an error occurred.
  3. Resource Release: Although the process has ended, it still holds an entry in the process table. However, it releases most other resources, including memory and file descriptors.
  4. Process Table Entry: The process table entry is retained to store the exit status of the process so that the parent process can read it. The entry includes the process ID (PID), the exit status, and some other administrative information.

Creation and Removal of Zombie Processes

  • Creation: A zombie process is created when a child process ends, and its parent process is either too busy or not designed correctly to read its exit status immediately.
  • Removal: The zombie process remains in the system until its parent process reads its exit status. This is typically done using the wait() or waitpid() system calls. Once the exit status is read, the operating system removes the zombie process from the process table, effectively cleaning it up.

Potential Issues with Zombie Processes

  • Accumulation: If a parent process never reads the exit status of its child processes, zombies can accumulate. While each individual zombie process doesn’t consume significant system resources, having a large number of them can exhaust the limited entries in the process table, potentially leading to system performance issues.
  • Prevention and Handling: Properly written programs should always handle the termination of their child processes to prevent the creation of zombie processes. This is typically done by handling the SIGCHLD signal, which is sent to a parent process when a child process terminates, and by calling wait() or waitpid().

In the context of signal handling in programs written in languages like C or C++, SIG_IGN is used as an argument to the signal() system call or sigaction() system call to specify that a particular signal should be ignored. When a signal is set to be ignored, the operating system discards the signal when it is sent to the process, and no action is taken.

To detect zombie processes in a Unix-like operating system, you can use the ps command, which displays information about the currently running processes. A zombie process will typically appear in the output with a status of Z or defunct. Here’s how you can do it:

Using the ps Command

Run the following command in the terminal:

ps aux | grep 'Z'
  • ps aux lists all running processes.
  • grep 'Z' filters the list to show only processes with a status of Z, which indicates a zombie process.

The output will show any zombie processes, if they exist. The columns provide information like the user who owns the process, the process ID (PID), the parent process ID (PPID), and the process status.

Understanding the Output

In the output of the ps command:

  • The STAT or S column shows the process status. A zombie process is marked with Z.
  • The CMD column shows the command that started the process. For zombie processes, this is the command that created the process before it became defunct.

Example Output

An example output might look like this:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
username  1234  0.0  0.0      0     0 ?        Z    12:34   0:00 [example_command] <defunct>

In this example, the process with PID 1234 is a zombie process. The <defunct> tag indicates that the process has completed execution but is still in the process table because its exit status has not been read by its parent process.

Orphaned Zombie Processes

Ihe init process, which is the first process started by the kernel and has a process ID (PID) of 1, plays a special role in handling zombie processes. When a process becomes a zombie, it means it has completed execution but still has an entry in the process table because its parent has not yet read its exit status. Here’s how init eventually cleans up zombie processes:

  1. Orphaned Zombie Processes: When the parent process of a zombie process dies, the orphaned zombie process is adopted by init. This is an automatic mechanism provided by the operating system.
  2. Reaping Zombies: The init process periodically executes a wait routine to collect the exit status of any zombie processes that it has adopted. This action of collecting the exit status is often referred to as “reaping.”
  3. Cleaning Up: Once init has reaped a zombie process, the process is completely removed from the process table. This frees up the entry in the process table that the zombie process was occupying.

Example Scenario

  • A process (let’s call it Process A) creates a child process (Process B).
  • Process B completes its execution and becomes a zombie because Process A has not yet issued a wait() system call to read its exit status.
  • If Process A terminates before it reads the exit status of Process B, Process B becomes an orphan.
  • The init process automatically adopts Process B.
  • init periodically calls wait() to clean up any zombie processes it has adopted, including Process B.

Manual Cleanup

In normal operation, you shouldn’t need to manually intervene to clean up zombie processes, as they should be handled by their parent processes or eventually by init. However, if you find that a particular process is creating zombies and not handling them correctly, you might need to modify the process’s code to ensure it properly waits for its child processes to prevent zombies from persisting.

Preventing Zombies

The best way to handle zombie processes is to prevent their creation in the first place. This is typically done by ensuring that parent processes correctly use the wait() or waitpid() system calls to collect the exit status of their child processes. Proper handling of the SIGCHLD signal, which is sent to a parent process when a child process terminates, is also crucial in managing child processes and preventing zombies.

1