88

This message appears when I login to my machine:

There is 1 zombie process.
  • What is it telling me?
  • Is this anything I should worry about?
  • If yes, then what should I do, and how?
damon
  • 171
John Mee
  • 2,698

3 Answers3

66

There's nothing to worry about :

Zombie

On Unix operating systems, a zombie process or defunct process is a process that has completed execution but still has an entry in the process table, allowing the process that started it to read its exit status. In the term's colorful metaphor, the child process has died but has not yet been reaped.

When a process ends, all of the memory and resources associated with it are deallocated so they can be used by other processes. However, the process's entry in the process table remains. The parent is sent a SIGCHLD signal indicating that a child has died; the handler for this signal will typically execute the wait system call, which reads the exit status and removes the zombie. The zombie's process ID and entry in the process table can then be reused. However, if a parent ignores the SIGCHLD, the zombie will be left in the process table. In some situations this may be desirable, for example if the parent creates another child process it ensures that it will not be allocated the same process ID.

Source : http://wiki.answers.com/Q/What_is_Zombie_Process_and_Orphan_Process

Marc-Andre R.
  • 2,587
  • 4
    Thanks Marc good description; now how would I find it, work out whether to keep it, and if not, thence remove it (and the message). – John Mee May 18 '12 at 01:04
  • 1
    Usaly they will go off by theirself, if this is really irritating you, you could reboot or find the parent process PID and kill it, but depends on what is leaving zombie behind, that could be problematic to kill that particular process. – Marc-Andre R. May 18 '12 at 01:48
  • 2
    Dont forget to accept my answer if this is the real answer to your question ;) thanks! – Marc-Andre R. May 20 '12 at 20:40
  • 13
    Sorry, you answered only the first part of his question. It's still unclear if one should worry about it and what to do about it. –  Oct 25 '12 at 03:39
  • 1
    If there's nothing to worry about - which I'm not doubting - then why does Ubuntu insist on announcing it on login in such a cryptic, alarming and ultimately pointless message? – Hashim Aziz Jan 04 '24 at 01:08
55

I was able to end the zombie process following this tutorial - https://vitux.com/how-to-kill-zombie-processes-in-ubuntu-18-04/.

Basically:

1) Identify the zombie process:

ps axo stat,ppid,pid,comm | grep -w defunct

2) Kill the parent process:

sudo kill -9 <parent_process_number>

Ex: enter image description here

guizo
  • 651
  • 15
    For anyone else like me, the parent_process_number is the first of the two numbers displayed. – user8675309 Jan 26 '21 at 16:35
  • 6
    You should not kill processes unless you know what they do. In some setups, "lots of zombies" is normal, and they will be cleaned up later -- for example, Jenkins controlling a docker container starts a cat process inside the container to keep it running, and then submits the actual jobs via docker exec, but this makes the cat process responsible for reaping the zombies, which it doesn't do. After the build, the cat process exits and the zombies are reaped normally, until then, they use several kilobytes of memory. – Simon Richter Apr 22 '21 at 09:02
  • I found exic's answer to give more context, as it will show where a process originated (all its predecessors, including the parent) – oligofren Jul 03 '23 at 06:42
8

As explained in the accepted answer, you have a process that has completed execution but is still in process table: https://serverfault.com/a/390216/48449

This shouldn't cause harm if it's only one process, but still shouldn't happen. If there are too many and you don't reboot or restart the causing parent process that produces those, you could reach your maximum number of allowed processes and cause serious issues.

To find out if worry is appropriate and which other process the zombie belongs to, this works for me:

ps -elf --forest | grep -C5 '<[d]efunct>'

Increase the number of context lines if necessary to find out about the parent process, ideally fix that process to make it "reap" its ended subprocesses.

exic
  • 629
  • If you change that -C5 to -B5 you will trim away the lines after the hit, which are just noise anyhow. B=Before. C=Context (Before+After). A=After. – oligofren Jul 03 '23 at 06:43