Killing zombie process

by on May 26, 2006 · 36 comments· LAST UPDATED September 19, 2006

in , ,

Zombie process is an inactive computer process, according to wikipedia article, "...On Unix operating systems, a zombie process or defunct process is a process that has completed execution but still has an entry in the process table, allowing the process that started it to read its exit status. In the term's colorful metaphor, the child process has died but has not yet been reaped..."

So how do I find out zombie process?

Use top or ps command:
# top
OR
# ps aux | awk '{ print $8 " " $2 }' | grep -w Z

Output:

Z 4104
Z 5320
Z 2945

How do I kill zombie process?

You cannot kill zombies, as they are already dead. But if you have too many zombies then kill parent process or restart service.

You can kill zombie process using PID obtained from any one of the above command. For example kill zombie proces having PID 4104:
# kill -9 4104

Please note that kill -9 does not guarantee to kill a zombie process (see below for more info).

How do I automate zombie process killing?

Write a script and schedule as a cron job.

See also:

What are these zombie processes that show up in ps? I kill them but they don't go away! by David Newall.

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 36 comments… read them below or add one }

1 rdk June 8, 2006 at 1:58 am

My friend is using something as follow (he calls it as linux zombies kill script.. LOL)

for each in `ps jauxww | grep Z | grep -v PID | awk ‘{print $3}’`; do for every in `ps auxw | grep $each | grep cron | awk ‘{print $2}’`; do kill -9 $every; done; done

Hope it will be useful to someone.

Reply

2 ldogan September 19, 2006 at 8:31 pm

help me…

awk: cmd. line:1: .{print
awk: cmd. line:1: ^ syntax error
awk: cmd. line:2: (END OF FILE)
awk: cmd. line:2: syntax error
ERROR: Conflicting format options.

Reply

3 nixCraft September 19, 2006 at 10:52 pm

Just copy and paste the code. I have fixed the css code problem.

Reply

4 lee colleton October 3, 2006 at 5:23 pm

grepping for the “word” Z won’t show Zombies that are also session leaders (such as Xorg) which show up as Zs

recommend ending with “| grep Z”

Reply

5 James March 27, 2007 at 3:54 pm

You should read the Wikipedia article more closely. There is no point sending a SIGKILL to a zombie process.

$ cat makezombie.c
#include
#include
#include
#include

int main(int argc, char *argv[])
{
pid_t child;

for (;;)
{
child = fork();
if (0 == child)
{
/* Whaddya know, I am the walrus^Wchild. Announce myself and
* exit immediately, making myself a zombie.
*/
fprintf(stdout, “Child PID is %ld\n”, (signed long int)getpid());
exit(0);
}
else if (child > 0)
{
/* I’m the parent. Loop without
* reaping the child.
*/
for (;;)
{
sleep(1);
}
}
else
{
/* fork() failed. Wait and try again. */
perror(“fork”);
sleep(1);
}
}
}
$ cc makezombie.c -o makezombie
$ ls -l makezombie
-rwxr-x— 1 youngman eng 9871 Mar 27 16:52 makezombie
$ ps
PID TTY TIME CMD
1769 pts/2 00:00:00 bash
2348 pts/2 00:00:00 ps
$ ./makezombie &
[1] 2351
$ Child PID is 2352
ps
PID TTY TIME CMD
1769 pts/2 00:00:00 bash
2351 pts/2 00:00:00 makezombie
2352 pts/2 00:00:00 makezombie
2353 pts/2 00:00:00 ps
$ kill -9 2352; echo $?
0
$ ps
PID TTY TIME CMD
1769 pts/2 00:00:00 bash
2351 pts/2 00:00:00 makezombie
2352 pts/2 00:00:00 makezombie
2356 pts/2 00:00:00 ps
$ kill 2351
$ ps
PID TTY TIME CMD
1769 pts/2 00:00:00 bash
2364 pts/2 00:00:00 ps
[1]+ Terminated ./makezombie
$

Reply

6 aditya April 27, 2007 at 6:36 am

Plz tell me !
The difference between a thread and a process.
Plz give a detailed explanation.
I hope you will not let me down.
Thank you.

Reply

7 schwarz July 27, 2007 at 2:16 pm

The first script has major issues with it. This is the one that I use

for each in `ps -ef | grep ” | grep -v PID | awk ‘{ print $3 }’`; do for every in `ps -ef | grep $each | grep -v cron | awk ‘{ print $2 }’`; do kill -9 $every; done; done

Reply

8 Pratik Kumar Mishra December 5, 2007 at 6:36 am

thanks.
I Got my ans of zombie Process.

Reply

9 AYAK January 30, 2008 at 12:26 pm

The thread is some thing like background job for the process smiler to project count from 1 till 100 and the main purpose of the project is get each number value.
eg in our daily life is some programs can’t do any thing until it’s main job done like some sort of Anti Virus’s when you tried to do another job the program dosen’t respond to any command in the main time i’s in the same process but it take her own mem space :D
i hope i was any useful for you :D

Reply

10 Don June 11, 2008 at 8:22 pm
#!/usr/bin/bash
#
# zombie_slayer [OPTIONS]
#
# -d
#   Just display the zombie processes and exit
#
# -h | help
#   Display help
#
# Default is to show processes and the ask what to kill (exits if any errors when killing processes)
#
function Z_Display
{
    echo ""
    echo "Proc - PID - PPID - State - User"
    UNIX95= ps -eo comm,pid,ppid,state,user | awk '$4 ~ /Z/ { print $1,$2,$3,$4,$5 }'
    echo ""
}
function Z_Kill
{
    read -p "Enter PPID to kill or 'exit' : " SLAY_PPID
    if [ "$SLAY_PPID" = "exit" ] || [ "$SLAY_PPID" = "" ]
    then
        exit
    fi
    ps -p $SLAY_PPID | grep -q $SLAY_PPID
    if [ $? -eq 0 ]
    then
        UNIX95= ps -o pid,user,state,comm -p $SLAY_PPID | \
        awk '$1 ~ /^[0-9]*$/ { print "The program " $4 " with PID " $1 " is being run by the user " $2 " and is currently in state " $3 }'
        read -p "Are you sure you want to kill PID $SLAY_PPID ? Y|N : " COMMIT_KILL
        if [ "$COMMIT_KILL" = "Y" ] || [ "$COMMIT_KILL" = "y" ]
        then
            kill -9 $SLAY_PPID
            if [$? -eq 0]
            then
                echo ""
                read -p "Killed PID $SLAY_PPID. Run again? Y/N : " GO_AGAIN
            fi
        else
            Z_Kill
        fi
    else
        echo "Invalid PID. Try again."
        echo ""
        Z_Kill
    fi
}
function help
{
    echo "Usage: zombie_slayer [-h | help -d]"
    echo "-d just display zombie processes and exit"
    echo "-h | help : This help"
    exit
}
if [ "$1" = "-h" ] || [ "$1" = "help" ]
then
    help
fi
if [ "$1" = "-d" ]
then
    Z_Display
else
    Z_Display
    Z_Kill
fi
if [ "$GO_AGAIN" = "Y" ] || [ "$GO_AGAIN" = "y" ]
then
    Z_Display
    Z_Kill
fi
echo ""

Reply

11 Don June 17, 2008 at 5:09 pm

Updated and tested with HP-UX 11i, Solaris 10, Debian, RHEL4 and SUSE 10

#!/usr/bin/bash
#
# Zombie Slayer
#
# zombie_slayer [OPTIONS]
#
# -d
#   Just diplay the zombie processes and exit
#
# -h | help
#   Display help
#
# Default is to show processes and the ask what to kill
#
function Z_Display
{
    echo ""
    echo "PID - PPID - State - User - Proc"
    UNIX95= ps -eo pid,ppid,state,user,comm | awk 'BEGIN { count=0 } $3 ~ /Z/ { count++; print $1,$2,$3,$4,$5 } END { print "\n" count " Zombie(s) to slay." }'
    echo ""
}
function Z_Kill
{
    read -p "Enter PPID to kill or 'exit' : " SLAY_PPID
    if [ "$SLAY_PPID" = "exit" ] || [ "$SLAY_PPID" = "" ]
    then
        exit
    fi
    ps -p $SLAY_PPID | grep -q $SLAY_PPID
    if [ $? -eq 0 ]
    then
        UNIX95= ps -o pid,user,state,comm -p $SLAY_PPID | \
        awk '$1 ~ /^[0-9]*$/ { print "The program " $4 " with PID " $1 " is being run by the user " $2 " and is currently in state " $3 }'
        read -p "Are you sure you want to kill PID $SLAY_PPID ? Y|N : " COMMIT_KILL
        if [ "$COMMIT_KILL" = "Y" ] || [ "$COMMIT_KILL" = "y" ]
        then
            kill -9 $SLAY_PPID
            echo ""
            read -p "Killed PID $SLAY_PPID. Run again? Y/N : " GO_AGAIN
        else
            Z_Kill
        fi
    else
        echo "Invalid PID. Try again."
        echo ""
        Z_Kill
    fi
}
function help
{
    echo "Usage: zombie_slayer [-h | help -d]"
    echo "-d just display zombie processes and exit"
    echo "-h | help : This help"
    exit
}
if [ "$1" = "-h" ] || [ "$1" = "help" ]
then
    help
fi
if [ "$1" = "-d" ]
then
    Z_Display
else
    Z_Display
    Z_Kill
fi
if [ "$GO_AGAIN" = "Y" ] || [ "$GO_AGAIN" = "y" ]
then
    Z_Display
    Z_Kill
fi
echo ""

Reply

12 none January 30, 2009 at 2:50 pm

Quick ‘n dirty hack:

ps ax | awk ‘{ if ($NF == “”) print $1 }’ | xargs kill -9

Reply

13 none January 30, 2009 at 2:55 pm

I guess the html is stripped, hope at least one works, I mean $NF == defunct between “less than” and “greater than”:

ps ax | awk ‘{ if ($NF == “&#60defunct&#62″) print $1 }’ | xargs kill -9

ps ax | awk ‘{ if ($NF == “\”) print $1 }’ | xargs kill -9

Reply

14 foo March 10, 2009 at 9:42 pm

You need to send the parent process a SIGCHLD or kill it

ps -eo pid,ppid,user,args,stat –sort stat | grep Z | awk ‘{ print $2 }’ | sort -u

gives you the parent process id(s)

kill -s SIGCHLD
or
kill

Reply

15 Paul April 24, 2009 at 4:39 pm

First things first, I am amazed at the amount of time so many people have put into dealing with such a non-issue. Zombie processes are dead, they consume nearly zero system resources. The only time you should be concerned is if you have a large number of them and said number is continuing to grow, in which case getting rid of the zombies is not your problem. You need to find out why you have them in the first place. Removing them is like taking a cold tablet, you are deling with the symptom, not the real problem.

That said, you should never, ever be using ‘kill -9′, that is an absolute last-ditch resort for dealing with a system that is almost non-functional or in some other critical state. Having a few zombie processes tying up nearly no resources at all is not a critical state, and using kill -9 is like chasing a mouse with a heavy hammer; you’re not likely to get the mouse, but you may do extensive damage to everything around you in the process.

So, what to do? find out what is spawning these processes, and why it is not shutting them down when they exit. See if there is a patch that fixes the issue. Make a report to the maintainers of the package. Restart the parent process. Or to reiterate, find out the cause of the problem and fix that.

Reply

16 lostboy November 26, 2010 at 12:41 pm

To Paul

you’re not likely to get the mouse, but you may do extensive damage to everything around you in the process.

if I use kill -9 to erase zombies from servers what kind of problems might I cause ?
can you give me a hint
thanks

Reply

17 Lesh July 9, 2009 at 12:06 pm

ps -ef | grep defunct | awk ‘{ print $3 }’ | xargs kill -9

Reply

18 Love March 21, 2013 at 1:46 am

This worked for me.

Reply

19 steveus christ August 13, 2009 at 4:19 pm

if u want to kill a zombie. just shoot it till it stops moving. its that simple. u should probably shoot the forhead. or the noggin. use a machete or a shotgun seem to work well. when the zombie apocolyps comes. set up traps and execute them. at costs dont let ur zombie bite u.

Reply

20 Don August 13, 2009 at 4:55 pm

I know this is old but WTH –

I wrote the script above because we had several developers on a group of HPUX boxes testing a complicated MPE ported application. In many situations runaway processes would create zombie children which would alert us to problematic code. This script would tell me what process created them and who the developer was who kicked it off. Very helpful to me, and I thought that someone, somewhere might benefit from it. Since it is still here and ya’ll are finding it when you search for “how to Kill Zombie processes” it looks like maybe I was right :) Maybe someone learned some basic scripting skills too ;) Isn’t that what the internet is for?

Reply

21 tangbq December 9, 2009 at 6:14 am

ps aux | awk ‘{ print $8 ” ” $2 }’ | grep ‘Z’ |awk ‘{print $2}’ |xargs kill -9

Reply

22 Yo December 17, 2009 at 1:40 pm

Nice comments by Paul and Steveus
I even like a youtube video titled as “How to Kill a Zombie”
Do search and watch it, Its a must lesson for all of the geeks here !!!
Oops I forgot to say – Nice document by Nixcraft and best feature is I can save it as PDF.
Thanks!!

Reply

23 Bill September 9, 2010 at 4:06 pm

cI have a windows machine (win2k) that has what I consider to be a zombie process. Here is the deal…

I have a command prompt open, within that command prompt I have an exe running.

When you look at the active program in the windows task manager, it shows the DOS window.
On the desktop, ther is an open DOS window, and you can see it last executed the progam (delay), but has not returned.

If you Right click on the program in task manage, and choose go to process, there is no CMD process, Further more, the program that is running within that environment, is also NOT listed.

I am remote administrating this machine, and have attempted to reboot, but it will not reboot. I have written VB scripts to shutdown and reboot all the OS processes, but still no go.

Call it a zombie, call it a ghost, call it what you will…. It is there and will not go away without a full and complete shutdown of the machine (which I will have to do). But does anybody know 1) how this happens, or 2) how to resolve without a physical warm or cold boot?

Reply

24 Florian December 14, 2010 at 1:03 pm

hi

A simple work ?
kill -9 $(ps aux | awk ‘{print $2,$8}’ | grep Z | awk ‘{print $1}’)

King Regard

Reply

25 hemanth April 5, 2011 at 11:07 am

ps -el | grep ‘Z’

No no no. Don’t use kill -9.

It doesn’t give the process a chance to cleanly:

1) shut down socket connections

2) clean up temp files

3) inform its children that it is going away

4) reset its terminal characteristics

and so on and so on and so on.

Reply

26 Ray April 11, 2012 at 10:56 am

Heh… I have a university computer science instructor that regularly uses “kill -9 -1″ as a quick way to log off of his box…. his system still works fine.

Not that it can not cause problems, but don’t confuse the potential of causing problems with a guarantee of problems. Just like you can usually use sudo instead of gksudo without issues, except in the rare instances that you can’t.

Not that I am indorsing “kill -9 -1″ as a substitute for logging off cleaning.

Reply

27 Sanjaya Srivastava May 12, 2011 at 5:54 pm

Well Solaris9+ offers preap command to reap zombie processes.

Reply

28 Sridhar Gumpula October 18, 2011 at 2:54 am

# ps -elf | awk ‘{ print $2 ” ” $4 }’ | grep -w Z
Z 2019
Z 2803
# kill -9 2019
#

Reply

29 Marc February 20, 2012 at 3:53 pm

Comment l’on peut mettre une commande comme ça en alias???

Genre alias psz=’ps -elf | awk \‘{ print $2 ” ” $4 }\’ | grep -w Z’

Car le back slash \ ne fonctionne pas dans le cas ici??

Reply

30 uranium June 25, 2012 at 7:17 pm

For me following command works perfectly:

ps -elf | awk ‘{print $2 ” ” $5}’ | grep -w Z | awk ‘{print $2}’ | xargs kill -9

Short explanation by | :
1. print process info
2. print process status and PARENT process id
3. grep only zombie processes
4. print only pid (parent)
5. pass everything to kill -9

Reply

31 Ehsan June 26, 2012 at 6:26 am

Please forget kill -9 -1
I tried it on opensuse, whole system hanged

Reply

32 James Carter September 27, 2012 at 2:24 pm

Don,

Thank you for the script… nice to see assistance on comments / forums for a change.

Paul? Java developer? ;-)

Reply

33 Mitch Milner March 14, 2013 at 9:03 pm

Here is a script I created to kill ALL zombie processes. It uses the GDB debugger to attach to the parent process and send a waitpid to kill the zombie process. This will leave the parent live and only slay the zombie.

GDB debugger will need to be installed and you will need to be logged in with permissions to attach to a process. This has been tested on Centos 6.3

    #!/bin/bash
    ##################################################################
    # Script: Zombie Slayer
    # Author: Mitch Milner
    # Date:   03/13/2013 ---> A good day to slay zombies
    #
    # Requirements: yum install gdb
    #               permissions to attach to the parent process
    #
    # This script works by using a debugger to
    # attach to the parent process and then issuing
    # a waitpid to the dead zombie. This will not kill
    # the living parent process.
    ##################################################################
    clear
    # Wait for user input to proceed, give user a chance to cancel script
    echo "***********************************************************"
    echo -e "This script will terminate all zombie process."
    echo -e "Press [ENTER] to continue or [CTRL] + C to cancel:"
    echo "***********************************************************"
    read cmd_string
    echo -e "\n"
    # initialize variables
    intcount=0
    lastparentid=0
    # remove old gdb command file
    rm -f /tmp/zombie_slayer.txt
    # create the gdb command file
    echo "***********************************************************"
    echo "Creating command file..."
    echo "***********************************************************"
    ps -e -o ppid,pid,stat,command | grep Z | sort | while read LINE; do
      intcount=$((intcount+1))
      parentid=`echo $LINE | awk '{print $1}'`
      zombieid=`echo $LINE | awk '{print $2}'`
      verifyzombie=`echo $LINE | awk '{print $3}'`
      # make sure this is a zombie file and we are not getting a Z from
      # the command field of the ps -e -o ppid,pid,stat,command
      if [ "$verifyzombie" == "Z" ]
      then
        if [ "$parentid" != "$lastparentid" ]
        then
          if [ "$lastparentid" != "0" ]
          then
            echo "detach" >> /tmp/zombie_slayer.txt
          fi
        echo "attach $parentid" >> /tmp/zombie_slayer.txt
        fi
        echo "call waitpid ($zombieid,0,0)" >> /tmp/zombie_slayer.txt
        echo "Logging: Parent: $parentid  Zombie: $zombieid"
        lastparentid=$parentid
      fi
    done
    if [ "$lastparentid" != "0" ]
    then
      echo "detach" >> /tmp/zombie_slayer.txt
    fi
    # Slay the zombies with gdb and the created command file
    echo -e "\n\n"
    echo "***********************************************************"
    echo "Slaying zombie processes..."
    echo "***********************************************************"
    gdb -batch -x /tmp/zombie_slayer.txt
    echo -e "\n\n"
    echo "***********************************************************"
    echo "Script complete."
    echo "***********************************************************"

Enjoy.

Reply

34 StygianAgenda May 9, 2013 at 9:27 pm

Interesting…

I used the code:
ps aux | awk ‘{ print $8 ” ” $2 }’ | grep -w Z

It worked to ID the actual zombie processes, but all things considered, this isn’t something that I would leave to an automated script. Once I had the PIDs, in a second terminal I opened ‘htop’ and traced down the PIDs to determine what application was leaving zombies behind. Realizing that the process was ‘lightdm’, I simply restarted that service, and all of the zombies went away immediately. :)

So, like I say, the script is interesting… and useful, but I wouldn’t rely on a script for something that is better suited to a pair of eyes and human intuition.

Reply

35 John July 31, 2013 at 12:52 am

Those who consider all zombie processes to be a non-issue should re-consider.

Sometimes zombie’s despite their status, continue to max out your CPU(s). I’ve just had Nautilus (surprise, surprise) hogging a CPU and it took a OS restart to fix it – not very elegant! The ‘parent’ was the nfs service (once again) that caused Nautilus to hang. No wonder so few people use Nautilus these days – that’s one of the few things that can bring Linux to its knees. I even opened System Monitor as root and killed as much nfs stuff as I could, but without result.

I also tried the big script on this page but zombified-Nautilus just laughed at it. Wish I had tried some of the follow-on one-liners, some of them look interesting…

Reply

36 John July 31, 2013 at 12:55 am

Oops – that should have read “No wonder so few people use nfs these days”…

Reply

Leave a Comment

Previous post:

Next post: