How to find and Kill all ‘Zombie processes’ running on server?

Did you ever notice some processes with status “Z” on your server/system?

These are Zombies. On this article I’m explaining the ways to find and kill all Zombies on the server.

On Unix operating systems, a zombie process or defunct process is a process that has completed execution but still has an entry in the process table, allowing the process that started it to read its exit status. It almost always means that the parent is still around. If the parent exited, the child would be orphaned and re-parented to init, which would immediately perform the wait. In other words, they should go away once the parent process is done.

A zombie process doesn’t react to signals.

1. How can I get the Zombies from process list?

Its very simple! You can find out the Zombie processes in different ways:

# ps aux |grep "defunct"

arun      3366  0.0  0.0      0     0 ?        Z    07:34   0:00 [chromium-browse] defunct
arun      3435  0.0  0.0      0     0 ?        Z    07:44   0:19 [chromium-browse] defunct
arun      3722  0.0  0.0      0     0 ?        Z    08:21   0:00 [pidgin] defunct
arun      4287  0.1  0.0      0     0 ?        Z    09:26   0:38 [chromium-browse] defunct
arun      5378  0.1  0.0      0     0 ?        Z    11:24   0:15 [chromium-browse] defunct
# ps aux |grep Z

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
arun      3366  0.0  0.0      0     0 ?        Z    07:34   0:00 [chromium-browse] 
arun      3435  0.0  0.0      0     0 ?        Z    07:44   0:19 [chromium-browse] 
arun      3722  0.0  0.0      0     0 ?        Z    08:21   0:00 [pidgin] 
arun      4287  0.1  0.0      0     0 ?        Z    09:26   0:38 [chromium-browse] 
arun      5378  0.1  0.0      0     0 ?        Z    11:24   0:15 [chromium-browse]

2. How many Zombie processes running on your server? Juz count it out!

This is just to make a count of Zombie processes on the server. It can be done in different ways.
Please see some examples.

# ps aux | awk {'print $8'}|grep -c Z
5
# ps aux | awk '{ print $8 " " $2 }' | grep -wc Z
5
# ps aux | awk {'print $8'}|grep Z|wc -l
5

3. List the PID of Zombie?

# ps aux | awk '{ print $8 " " $2 }' | grep -w Z
Z 3366
Z 3435
Z 3722
Z 4287
Z 5378

In order to kill these processes, you need to find the parent process first.

# pstree -paul

See the sample output:

[root@vps ~]# pstree -paul
init,1
  |-crond,542
  |-dovecot,6576
  |   |-anvil,6577,dovecot
  |   |-config,25099
  |   `-log,6578
  |-httpd,5047
  |   |-httpd,1900,apache
  |   |-httpd,9428,apache
  |   |   |-php-cgi,1904,ctalk
  |   |   |-php-cgi,11989,ctalk
  |   |   `-php-cgi,11994,ctalk
  |   |-httpd,19203,apache
  |   |-httpd,22975,apache
  |   |-httpd,25197,apache
  |   `-httpd,30417,apache
  |-(kthreadd/3929,2)
  |   `-(khelper/3929,3)
  |-master,5227
........

This will show the pid of the of the parent of the zombie process. Now you need to kill the parent process or restart the service.

[root@server]# kill -9

That’s it! Try this and let me know if you’ve any questions.

Also see;

10+ commonly using find command switches with example Unix/Linux

Arunlal Ashok

Sr. Linux Server Administrator. I'm managing Linux servers since 2012. I started this blog to share and discuss my ideas. Check My Profile in uPwork (oDesk) and create a job, if you need any administration help. Thanks!!

You may also like...

4 Responses

  1. denny says:

    I would suggest kill -term for parent process, before kill -9

  2. Dave says:

    I am looking at the sample output of pstree -paul. Should it be obvious to me what is the PID of the parent of the zombie? Sorry, I’m too stupid.

    Instead, since we know the PID of the zombie, why not just

    ps -ef|grep

    Parent will be in column 3, sombie pid in col 2.

  3. Ronny Sherer says:

    You can kill all zombies like that:
    kill -9 `ps aux | awk ‘{if ($8==”Z”) print $1}’`

Leave a Reply

Your email address will not be published. Required fields are marked *