≡ Menu

Killing zombie process

Zombie process is an inactive computer process, according to wikipedia article, "...On Unix operating systems, a zombie process or defunct process is a process that has completed execution but still has an entry in the process table, allowing the process that started it to read its exit status. In the term's colorful metaphor, the child process has died but has not yet been reaped..."

So how do I find out zombie process?

Use top or ps command:
# top
OR
# ps aux | awk '{ print $8 " " $2 }' | grep -w Z

Output:

Z 4104
Z 5320
Z 2945

How do I kill zombie process?

You cannot kill zombies, as they are already dead. But if you have too many zombies then kill parent process or restart service.

You can kill zombie process using PID obtained from any one of the above command. For example kill zombie proces having PID 4104:
# kill -9 4104

Please note that kill -9 does not guarantee to kill a zombie process (see below for more info).

How do I automate zombie process killing?

Write a script and schedule as a cron job.

See also:

What are these zombie processes that show up in ps? I kill them but they don't go away! by David Newall.

Tweet itFacebook itGoogle+ itPDF itFound an error/typo on this page?

{ 36 comments… add one }

  • rdk June 8, 2006, 1:58 am

    My friend is using something as follow (he calls it as linux zombies kill script.. LOL)

    for each in `ps jauxww | grep Z | grep -v PID | awk ‘{print $3}’`; do for every in `ps auxw | grep $each | grep cron | awk ‘{print $2}’`; do kill -9 $every; done; done

    Hope it will be useful to someone.

  • ldogan September 19, 2006, 8:31 pm

    help me…

    awk: cmd. line:1: .{print
    awk: cmd. line:1: ^ syntax error
    awk: cmd. line:2: (END OF FILE)
    awk: cmd. line:2: syntax error
    ERROR: Conflicting format options.

  • nixCraft September 19, 2006, 10:52 pm

    Just copy and paste the code. I have fixed the css code problem.

  • lee colleton October 3, 2006, 5:23 pm

    grepping for the “word” Z won’t show Zombies that are also session leaders (such as Xorg) which show up as Zs

    recommend ending with “| grep Z”

  • James March 27, 2007, 3:54 pm

    You should read the Wikipedia article more closely. There is no point sending a SIGKILL to a zombie process.

    $ cat makezombie.c
    #include
    #include
    #include
    #include

    int main(int argc, char *argv[])
    {
    pid_t child;

    for (;;)
    {
    child = fork();
    if (0 == child)
    {
    /* Whaddya know, I am the walrus^Wchild. Announce myself and
    * exit immediately, making myself a zombie.
    */
    fprintf(stdout, “Child PID is %ld\n”, (signed long int)getpid());
    exit(0);
    }
    else if (child > 0)
    {
    /* I’m the parent. Loop without
    * reaping the child.
    */
    for (;;)
    {
    sleep(1);
    }
    }
    else
    {
    /* fork() failed. Wait and try again. */
    perror(“fork”);
    sleep(1);
    }
    }
    }
    $ cc makezombie.c -o makezombie
    $ ls -l makezombie
    -rwxr-x— 1 youngman eng 9871 Mar 27 16:52 makezombie
    $ ps
    PID TTY TIME CMD
    1769 pts/2 00:00:00 bash
    2348 pts/2 00:00:00 ps
    $ ./makezombie &
    [1] 2351
    $ Child PID is 2352
    ps
    PID TTY TIME CMD
    1769 pts/2 00:00:00 bash
    2351 pts/2 00:00:00 makezombie
    2352 pts/2 00:00:00 makezombie
    2353 pts/2 00:00:00 ps
    $ kill -9 2352; echo $?
    0
    $ ps
    PID TTY TIME CMD
    1769 pts/2 00:00:00 bash
    2351 pts/2 00:00:00 makezombie
    2352 pts/2 00:00:00 makezombie
    2356 pts/2 00:00:00 ps
    $ kill 2351
    $ ps
    PID TTY TIME CMD
    1769 pts/2 00:00:00 bash
    2364 pts/2 00:00:00 ps
    [1]+ Terminated ./makezombie
    $

  • aditya April 27, 2007, 6:36 am

    Plz tell me !
    The difference between a thread and a process.
    Plz give a detailed explanation.
    I hope you will not let me down.
    Thank you.

  • schwarz July 27, 2007, 2:16 pm

    The first script has major issues with it. This is the one that I use

    for each in `ps -ef | grep ” | grep -v PID | awk ‘{ print $3 }’`; do for every in `ps -ef | grep $each | grep -v cron | awk ‘{ print $2 }’`; do kill -9 $every; done; done

  • Pratik Kumar Mishra December 5, 2007, 6:36 am

    thanks.
    I Got my ans of zombie Process.

  • AYAK January 30, 2008, 12:26 pm

    The thread is some thing like background job for the process smiler to project count from 1 till 100 and the main purpose of the project is get each number value.
    eg in our daily life is some programs can’t do any thing until it’s main job done like some sort of Anti Virus’s when you tried to do another job the program dosen’t respond to any command in the main time i’s in the same process but it take her own mem space :D
    i hope i was any useful for you :D

  • Don June 11, 2008, 8:22 pm
    #!/usr/bin/bash
    #
    # zombie_slayer [OPTIONS]
    #
    # -d
    #   Just display the zombie processes and exit
    #
    # -h | help
    #   Display help
    #
    # Default is to show processes and the ask what to kill (exits if any errors when killing processes)
    #
    function Z_Display
    {
        echo ""
        echo "Proc - PID - PPID - State - User"
        UNIX95= ps -eo comm,pid,ppid,state,user | awk '$4 ~ /Z/ { print $1,$2,$3,$4,$5 }'
        echo ""
    }
    function Z_Kill
    {
        read -p "Enter PPID to kill or 'exit' : " SLAY_PPID
        if [ "$SLAY_PPID" = "exit" ] || [ "$SLAY_PPID" = "" ]
        then
            exit
        fi
        ps -p $SLAY_PPID | grep -q $SLAY_PPID
        if [ $? -eq 0 ]
        then
            UNIX95= ps -o pid,user,state,comm -p $SLAY_PPID | \
            awk '$1 ~ /^[0-9]*$/ { print "The program " $4 " with PID " $1 " is being run by the user " $2 " and is currently in state " $3 }'
            read -p "Are you sure you want to kill PID $SLAY_PPID ? Y|N : " COMMIT_KILL
            if [ "$COMMIT_KILL" = "Y" ] || [ "$COMMIT_KILL" = "y" ]
            then
                kill -9 $SLAY_PPID
                if [$? -eq 0]
                then
                    echo ""
                    read -p "Killed PID $SLAY_PPID. Run again? Y/N : " GO_AGAIN
                fi
            else
                Z_Kill
            fi
        else
            echo "Invalid PID. Try again."
            echo ""
            Z_Kill
        fi
    }
    function help
    {
        echo "Usage: zombie_slayer [-h | help -d]"
        echo "-d just display zombie processes and exit"
        echo "-h | help : This help"
        exit
    }
    if [ "$1" = "-h" ] || [ "$1" = "help" ]
    then
        help
    fi
    if [ "$1" = "-d" ]
    then
        Z_Display
    else
        Z_Display
        Z_Kill
    fi
    if [ "$GO_AGAIN" = "Y" ] || [ "$GO_AGAIN" = "y" ]
    then
        Z_Display
        Z_Kill
    fi
    echo ""
    
  • Don June 17, 2008, 5:09 pm

    Updated and tested with HP-UX 11i, Solaris 10, Debian, RHEL4 and SUSE 10

    #!/usr/bin/bash
    #
    # Zombie Slayer
    #
    # zombie_slayer [OPTIONS]
    #
    # -d
    #   Just diplay the zombie processes and exit
    #
    # -h | help
    #   Display help
    #
    # Default is to show processes and the ask what to kill
    #
    function Z_Display
    {
        echo ""
        echo "PID - PPID - State - User - Proc"
        UNIX95= ps -eo pid,ppid,state,user,comm | awk 'BEGIN { count=0 } $3 ~ /Z/ { count++; print $1,$2,$3,$4,$5 } END { print "\n" count " Zombie(s) to slay." }'
        echo ""
    }
    function Z_Kill
    {
        read -p "Enter PPID to kill or 'exit' : " SLAY_PPID
        if [ "$SLAY_PPID" = "exit" ] || [ "$SLAY_PPID" = "" ]
        then
            exit
        fi
        ps -p $SLAY_PPID | grep -q $SLAY_PPID
        if [ $? -eq 0 ]
        then
            UNIX95= ps -o pid,user,state,comm -p $SLAY_PPID | \
            awk '$1 ~ /^[0-9]*$/ { print "The program " $4 " with PID " $1 " is being run by the user " $2 " and is currently in state " $3 }'
            read -p "Are you sure you want to kill PID $SLAY_PPID ? Y|N : " COMMIT_KILL
            if [ "$COMMIT_KILL" = "Y" ] || [ "$COMMIT_KILL" = "y" ]
            then
                kill -9 $SLAY_PPID
                echo ""
                read -p "Killed PID $SLAY_PPID. Run again? Y/N : " GO_AGAIN
            else
                Z_Kill
            fi
        else
            echo "Invalid PID. Try again."
            echo ""
            Z_Kill
        fi
    }
    function help
    {
        echo "Usage: zombie_slayer [-h | help -d]"
        echo "-d just display zombie processes and exit"
        echo "-h | help : This help"
        exit
    }
    if [ "$1" = "-h" ] || [ "$1" = "help" ]
    then
        help
    fi
    if [ "$1" = "-d" ]
    then
        Z_Display
    else
        Z_Display
        Z_Kill
    fi
    if [ "$GO_AGAIN" = "Y" ] || [ "$GO_AGAIN" = "y" ]
    then
        Z_Display
        Z_Kill
    fi
    echo ""
    
  • none January 30, 2009, 2:50 pm

    Quick ‘n dirty hack:

    ps ax | awk ‘{ if ($NF == “”) print $1 }’ | xargs kill -9

  • none January 30, 2009, 2:55 pm

    I guess the html is stripped, hope at least one works, I mean $NF == defunct between “less than” and “greater than”:

    ps ax | awk ‘{ if ($NF == “&#60defunct&#62”) print $1 }’ | xargs kill -9

    ps ax | awk ‘{ if ($NF == “\”) print $1 }’ | xargs kill -9

  • foo March 10, 2009, 9:42 pm

    You need to send the parent process a SIGCHLD or kill it

    ps -eo pid,ppid,user,args,stat –sort stat | grep Z | awk ‘{ print $2 }’ | sort -u

    gives you the parent process id(s)

    kill -s SIGCHLD
    or
    kill

  • Paul April 24, 2009, 4:39 pm

    First things first, I am amazed at the amount of time so many people have put into dealing with such a non-issue. Zombie processes are dead, they consume nearly zero system resources. The only time you should be concerned is if you have a large number of them and said number is continuing to grow, in which case getting rid of the zombies is not your problem. You need to find out why you have them in the first place. Removing them is like taking a cold tablet, you are deling with the symptom, not the real problem.

    That said, you should never, ever be using ‘kill -9’, that is an absolute last-ditch resort for dealing with a system that is almost non-functional or in some other critical state. Having a few zombie processes tying up nearly no resources at all is not a critical state, and using kill -9 is like chasing a mouse with a heavy hammer; you’re not likely to get the mouse, but you may do extensive damage to everything around you in the process.

    So, what to do? find out what is spawning these processes, and why it is not shutting them down when they exit. See if there is a patch that fixes the issue. Make a report to the maintainers of the package. Restart the parent process. Or to reiterate, find out the cause of the problem and fix that.

    • lostboy November 26, 2010, 12:41 pm

      To Paul

      you’re not likely to get the mouse, but you may do extensive damage to everything around you in the process.

      if I use kill -9 to erase zombies from servers what kind of problems might I cause ?
      can you give me a hint
      thanks

  • Lesh July 9, 2009, 12:06 pm

    ps -ef | grep defunct | awk ‘{ print $3 }’ | xargs kill -9

    • Love March 21, 2013, 1:46 am

      This worked for me.

  • steveus christ August 13, 2009, 4:19 pm

    if u want to kill a zombie. just shoot it till it stops moving. its that simple. u should probably shoot the forhead. or the noggin. use a machete or a shotgun seem to work well. when the zombie apocolyps comes. set up traps and execute them. at costs dont let ur zombie bite u.

  • Don August 13, 2009, 4:55 pm

    I know this is old but WTH –

    I wrote the script above because we had several developers on a group of HPUX boxes testing a complicated MPE ported application. In many situations runaway processes would create zombie children which would alert us to problematic code. This script would tell me what process created them and who the developer was who kicked it off. Very helpful to me, and I thought that someone, somewhere might benefit from it. Since it is still here and ya’ll are finding it when you search for “how to Kill Zombie processes” it looks like maybe I was right :) Maybe someone learned some basic scripting skills too ;) Isn’t that what the internet is for?

  • tangbq December 9, 2009, 6:14 am

    ps aux | awk ‘{ print $8 ” ” $2 }’ | grep ‘Z’ |awk ‘{print $2}’ |xargs kill -9

  • Yo December 17, 2009, 1:40 pm

    Nice comments by Paul and Steveus
    I even like a youtube video titled as “How to Kill a Zombie”
    Do search and watch it, Its a must lesson for all of the geeks here !!!
    Oops I forgot to say – Nice document by Nixcraft and best feature is I can save it as PDF.
    Thanks!!

  • Bill September 9, 2010, 4:06 pm

    cI have a windows machine (win2k) that has what I consider to be a zombie process. Here is the deal…

    I have a command prompt open, within that command prompt I have an exe running.

    When you look at the active program in the windows task manager, it shows the DOS window.
    On the desktop, ther is an open DOS window, and you can see it last executed the progam (delay), but has not returned.

    If you Right click on the program in task manage, and choose go to process, there is no CMD process, Further more, the program that is running within that environment, is also NOT listed.

    I am remote administrating this machine, and have attempted to reboot, but it will not reboot. I have written VB scripts to shutdown and reboot all the OS processes, but still no go.

    Call it a zombie, call it a ghost, call it what you will…. It is there and will not go away without a full and complete shutdown of the machine (which I will have to do). But does anybody know 1) how this happens, or 2) how to resolve without a physical warm or cold boot?

  • Florian December 14, 2010, 1:03 pm

    hi

    A simple work ?
    kill -9 $(ps aux | awk ‘{print $2,$8}’ | grep Z | awk ‘{print $1}’)

    King Regard

  • hemanth April 5, 2011, 11:07 am

    ps -el | grep ‘Z’

    No no no. Don’t use kill -9.

    It doesn’t give the process a chance to cleanly:

    1) shut down socket connections

    2) clean up temp files

    3) inform its children that it is going away

    4) reset its terminal characteristics

    and so on and so on and so on.

    • Ray April 11, 2012, 10:56 am

      Heh… I have a university computer science instructor that regularly uses “kill -9 -1” as a quick way to log off of his box…. his system still works fine.

      Not that it can not cause problems, but don’t confuse the potential of causing problems with a guarantee of problems. Just like you can usually use sudo instead of gksudo without issues, except in the rare instances that you can’t.

      Not that I am indorsing “kill -9 -1” as a substitute for logging off cleaning.

  • Sanjaya Srivastava May 12, 2011, 5:54 pm

    Well Solaris9+ offers preap command to reap zombie processes.

  • Sridhar Gumpula October 18, 2011, 2:54 am

    # ps -elf | awk ‘{ print $2 ” ” $4 }’ | grep -w Z
    Z 2019
    Z 2803
    # kill -9 2019
    #

  • Marc February 20, 2012, 3:53 pm

    Comment l’on peut mettre une commande comme ça en alias???

    Genre alias psz=’ps -elf | awk \‘{ print $2 ” ” $4 }\’ | grep -w Z’

    Car le back slash \ ne fonctionne pas dans le cas ici??

  • uranium June 25, 2012, 7:17 pm

    For me following command works perfectly:

    ps -elf | awk ‘{print $2 ” ” $5}’ | grep -w Z | awk ‘{print $2}’ | xargs kill -9

    Short explanation by | :
    1. print process info
    2. print process status and PARENT process id
    3. grep only zombie processes
    4. print only pid (parent)
    5. pass everything to kill -9

  • Ehsan June 26, 2012, 6:26 am

    Please forget kill -9 -1
    I tried it on opensuse, whole system hanged

  • James Carter September 27, 2012, 2:24 pm

    Don,

    Thank you for the script… nice to see assistance on comments / forums for a change.

    Paul? Java developer? ;-)

  • Mitch Milner March 14, 2013, 9:03 pm

    Here is a script I created to kill ALL zombie processes. It uses the GDB debugger to attach to the parent process and send a waitpid to kill the zombie process. This will leave the parent live and only slay the zombie.

    GDB debugger will need to be installed and you will need to be logged in with permissions to attach to a process. This has been tested on Centos 6.3

        #!/bin/bash
        ##################################################################
        # Script: Zombie Slayer
        # Author: Mitch Milner
        # Date:   03/13/2013 ---> A good day to slay zombies
        #
        # Requirements: yum install gdb
        #               permissions to attach to the parent process
        #
        # This script works by using a debugger to
        # attach to the parent process and then issuing
        # a waitpid to the dead zombie. This will not kill
        # the living parent process.
        ##################################################################
        clear
        # Wait for user input to proceed, give user a chance to cancel script
        echo "***********************************************************"
        echo -e "This script will terminate all zombie process."
        echo -e "Press [ENTER] to continue or [CTRL] + C to cancel:"
        echo "***********************************************************"
        read cmd_string
        echo -e "\n"
        # initialize variables
        intcount=0
        lastparentid=0
        # remove old gdb command file
        rm -f /tmp/zombie_slayer.txt
        # create the gdb command file
        echo "***********************************************************"
        echo "Creating command file..."
        echo "***********************************************************"
        ps -e -o ppid,pid,stat,command | grep Z | sort | while read LINE; do
          intcount=$((intcount+1))
          parentid=`echo $LINE | awk '{print $1}'`
          zombieid=`echo $LINE | awk '{print $2}'`
          verifyzombie=`echo $LINE | awk '{print $3}'`
          # make sure this is a zombie file and we are not getting a Z from
          # the command field of the ps -e -o ppid,pid,stat,command
          if [ "$verifyzombie" == "Z" ]
          then
            if [ "$parentid" != "$lastparentid" ]
            then
              if [ "$lastparentid" != "0" ]
              then
                echo "detach" >> /tmp/zombie_slayer.txt
              fi
            echo "attach $parentid" >> /tmp/zombie_slayer.txt
            fi
            echo "call waitpid ($zombieid,0,0)" >> /tmp/zombie_slayer.txt
            echo "Logging: Parent: $parentid  Zombie: $zombieid"
            lastparentid=$parentid
          fi
        done
        if [ "$lastparentid" != "0" ]
        then
          echo "detach" >> /tmp/zombie_slayer.txt
        fi
        # Slay the zombies with gdb and the created command file
        echo -e "\n\n"
        echo "***********************************************************"
        echo "Slaying zombie processes..."
        echo "***********************************************************"
        gdb -batch -x /tmp/zombie_slayer.txt
        echo -e "\n\n"
        echo "***********************************************************"
        echo "Script complete."
        echo "***********************************************************"
    

    Enjoy.

  • StygianAgenda May 9, 2013, 9:27 pm

    Interesting…

    I used the code:
    ps aux | awk ‘{ print $8 ” ” $2 }’ | grep -w Z

    It worked to ID the actual zombie processes, but all things considered, this isn’t something that I would leave to an automated script. Once I had the PIDs, in a second terminal I opened ‘htop’ and traced down the PIDs to determine what application was leaving zombies behind. Realizing that the process was ‘lightdm’, I simply restarted that service, and all of the zombies went away immediately. :)

    So, like I say, the script is interesting… and useful, but I wouldn’t rely on a script for something that is better suited to a pair of eyes and human intuition.

  • John July 31, 2013, 12:52 am

    Those who consider all zombie processes to be a non-issue should re-consider.

    Sometimes zombie’s despite their status, continue to max out your CPU(s). I’ve just had Nautilus (surprise, surprise) hogging a CPU and it took a OS restart to fix it – not very elegant! The ‘parent’ was the nfs service (once again) that caused Nautilus to hang. No wonder so few people use Nautilus these days – that’s one of the few things that can bring Linux to its knees. I even opened System Monitor as root and killed as much nfs stuff as I could, but without result.

    I also tried the big script on this page but zombified-Nautilus just laughed at it. Wish I had tried some of the follow-on one-liners, some of them look interesting…

  • John July 31, 2013, 12:55 am

    Oops – that should have read “No wonder so few people use nfs these days”…

Leave a Comment