Detailed explanation of Linux system zombie process

Da'an is good, I am Liang Xu.

In this article, we will discuss what a zombie process is, how it is generated, and how to kill a zombie process.

What is the process in Linux?

Speaking of process, we must first understand another concept: program.

just a file lying on the hard disk of the computer (161910f6c7bea5 is like the goddess of the hard disk ). Before it is executed by the CPU, it can't do anything.

When the program is executed, the instance it runs is called the process. A program can correspond to multiple processes.

The process is the unit of work of the system. The system is composed of multiple processes, some of which are operating system processes (execute system code), and others are user processes (execute user code). All of these processes will execute concurrently, for example by using multiplexing on a single CPU.

You can use the ps command to view all processes in the Linux system.

$ ps -ax
        PID TTY         STAT   TIME COMMAND
        1 ?     Ss      0:01 /usr/lib/systemd/systemd rhgb --switched-root --sys
        2 ?     S       0:00 [kthreadd]
        3 ?     I<      0:00 [rcu_gp]
        4 ?     I<      0:00 [rcu_par_gp]

When a process calls the fork function to generate another process, the original process is called the parent process, and the newly generated process is called the child process.

There are so many parent-child processes in the Linux system. We can use the pstree command to view the process "pedigree" on the system.

$ pstree -psn
systemd(1)─┬─systemd-journal(952)
        ├─systemd-udevd(963)
        ├─systemd-oomd(1137)
        ├─systemd-resolve(1138)
        ├─systemd-userdbd(1139)─┬─systemd-userwor(12707)
        │                     ├─systemd-userwor(12714)
        │                     └─systemd-userwor(12715)
        ├─auditd(1140)───{auditd}(1141)
        ├─dbus-broker-lau(1164)───dbus-broker(1165)
        ├─avahi-daemon(1166)───avahi-daemon(1196)
        ├─bluetoothd(1167)

Each process is assigned a number in the system. Among all these processes, there is a very special process whose ID number is 1. It is the first process executed by the system during the boot process, and every subsequent process after PID 1 is its descendant.

What is a zombie process?

As mentioned earlier, in the Linux environment, we use the fork function to create a child process. After creation, the parent and child processes run independently, and the parent process cannot predict when the child process will end.

Normally, after the child process exits, the parent process will use the wait or waitpid function to reclaim the child process's resources and obtain the child process's termination status.

However, if the parent process ends before the child process, the child process becomes an orphan process. The orphan process will be adopted by the init process (process number is 1), and the init process will complete the state collection work for the orphan process.

And if the child process exits before the parent process, and the parent process is too busy, the resources of the child process are recovered flawlessly, and the remaining resources (PCB) of the child process are stored in the kernel and become a zombie process, as shown in the following figure:

How did the zombie process come into being?

The principle of the zombie process has been introduced before, and we will use the code to simulate the zombie process.

#include  
#include  
#include  
#include  

int main(void)  
{  
    pid_t pid;  
    pid = fork();  
    if (pid == 0) {  
            printf("I am child, my parent= %d, going to sleep 3s\n", getppid());  
            sleep(3);  
            printf("-------------child die--------------\n");  
    } else if (pid > 0) {  
            printf("I am parent, pid = %d, myson = %d, going to sleep 5s\n", getpid(), pid);  
            sleep(5);  
            system("ps -o pid,ppid,state,tty,command");  
    } else {  
        perror("fork");  
        return 1;  
    }  

    return 0;  
}  

In this program, after the parent process creates the child process, it sleeps for 5 seconds. The child process only sleeps for 3 seconds and then exits. After it exits, the parent process has not yet woken up, so no one "collects the corpse" for the child process, so it becomes a zombie process.

How to kill zombie processes

For ordinary processes, we can kill them kill kill command also has several brothers, such as pkill and killall . Although their names have kill , they are actually designed to send signals to one or more processes.

If not specified, these commands send the SIGTERM signal by default.

Ordinary processes can be kill , but zombie processes are not. Why? Because the zombie process itself has been "dead" once! If you can still "die", then the name "zombie" won't make much sense.

The zombie process is actually an exited process, so the kill command can no longer be used to kill the zombie process. The culprit of the zombie process is that the parent process does not reclaim its resources. Then we can find a way for other processes to reclaim the resources of the zombie process. This process is the init process.

Therefore, we can directly kill the parent process, and the init process will adopt those zombie processes very kindly and reclaim their resources reasonably, and the zombie processes will be properly handled.

For example, if PID 5878 is a zombie process and its parent process is PID 4809, then to kill the zombie process (5878), you can end the parent process (4809):

$ sudo kill -9 4809  #4809 is the parent, not the zombie

Be very careful when killing the parent process. If the parent process of a process is PID 1 and you kill it, the system will restart directly!

This will be a more terrifying story!

---

Finally, recently, many friends asked me for the Linux learning roadmap , so based on my own experience, I spent a month staying up late in my spare time and compiled an e-book. Whether you are in an interview or self-improvement, I believe it will be helpful to you!

Give it to everyone for free, just ask you to give me a thumbs up!

e-book | Linux development and learning roadmap

I also hope that some friends can join me to make this e-book more perfect!

Gain? I hope that the old guys will have a three-strike combo, so that more people can read this article

Recommended reading:

• dry goods | essential resources for programmers, advanced architects, free
• book list | programmer must-read classic book list (HD PDF version)