How To Wiki
Advertisement

Zombie processes are undead, scary killing them isn't so easy

finding if zombies exist[]

  • execute the top command
  • one line is tasks:
    • Example output: Tasks: 63 total, 1 running, 61 sleeping, 0 stopped, 1 zombie

Who is zombie[]

  • execute:
ps aux | awk '"[Zz]" ~ $8 { printf("%s, PID = %d\n", $8, $2); }'
  • example output is zombie process status, process ID: Z+, PID = 5067

Kill the zombies[]

zombies are living dead, so the aren't always easy to kill.

  • Try executing: kill -9 PID
    • example: kill -9 5067
  • See is the zombie is still alive, undead
    • use the techniques above
  • If its still undead
    • get a cross or garlic, well reliable sources tell me the don't work. We must try something else
  • Kill the zombie's parent (process)
  • execute: ps ef
    • this will display a process (family) tree
    • find the command who is the PID matches the zombie then look at the parents and try killing them
  • example:
PID TTY      STAT   TIME COMMAND
5102 pts/3    Ss     0:00 bash MANPATH=/usr/local/share/man:/usr/share/man:/usr
5229 pts/3    R+     0:00  \_ ps ef MANPATH=/usr/local/share/man:/usr/share/man
4929 tty1     S+     0:00 -bash TERM=linux HOME=/home/zymos SHELL=/bin/bash USE
4954 tty1     S+     0:00  \_ /bin/sh /usr/bin/startx MANPATH=/usr/local/share/
4970 tty1     S+     0:00      \_ xinit /home/zymos/.xinitrc -- -nolisten tcp -
4975 tty1     S      0:01          \_ icewm MANPATH=/usr/local/share/man:/usr/s
4977 tty1     S      0:01              \_ xterm MANPATH=/usr/local/share/man:/u
4987 pts/0    Ss     0:00              |   \_ bash MANPATH=/usr/local/share/man
5090 pts/0    Sl+    1:31              |       \_ ./hydranode MANPATH=/usr/loca
5092 pts/0    Sl+    0:29              |           \_ ./hydranode-core --disabl
4978 tty1     S      0:00              \_ xterm -e /home/zymos/.icewm/startup M
4986 pts/1    Ss+    0:00              |   \_ /bin/sh /home/zymos/.icewm/startu
4993 pts/1    S+     0:00              |       \_ gaim    MANPATH=/usr/local/sh
4994 pts/1    S+     0:00              |       \_ /bin/bash /usr/libexec/mozill
5030 pts/1    Sl+    1:29              |       |   \_ /usr/lib/mozilla-firefox/
5067 pts/1    Z+     0:00              |       |       \_ [netstat] <defunct>
4995 pts/1    S+     0:00              |       \_ xterm MANPATH=/usr/local/shar
5032 pts/2    Ss+    0:00              |       |   \_ bash MANPATH=/usr/local/s
5085 pts/1    S+     0:00              |       \_ boinc_client MANPATH=/usr/loc
4981 tty1     S      0:00              \_ icewmtray MANPATH=/usr/local/share/ma
5060 pts/1    S+     0:00 /usr/libexec/gconfd-2 13 MANPATH=/usr/local/share/man
  • netstat matches the PID above, 5067
    • so in this example I would try killing
      • 5030 pts/1 Sl+ 1:29 /usr/lib/mozilla-firefox/
      • 4978 tty1 S 0:00 xterm -e /home/zymos/.icewm/startup M
        Or
      • 4986 pts/1 Ss+ 0:00 /bin/sh /home/zymos/.icewm/startu
  • Hopefully this will work
  • If you need a  single line command that does the work you can try
ps axu | awk '"[Zz] ~ $8 { system(sprintf("kill -HUP %d", $2)); }'
  • This will work in most cases
    • Check if the zombie process still exists; if so, run the same command but change -HUP to -TERM.
    • If the zombie is still there, use -9 instead of -HUP or -TERM.
      • -9 will terminate it for sure but it's considered very bad practice
      • FYI - The above is way too much work. Use killall <process-name> e.g. killall firefox

External links[]

Advertisement