Zombie processes running?

irin · 04-11-2012, 10:54 AM

Hi all,

I have the following processes running on one of my servers and I tried to run the kill and kill -9 command to get rid of them but they're still running. Can someone please let me know how I can stop these processes and what they are? Looks like zombie processes to me.

Thank you

Code:

[root@server ~]# ps -aux|grep 502
Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.3/FAQ
502       5461  0.0  0.0  3900  864 ?        D    Mar29   0:03 tar -czPf /home/username/fileg.tar.gz /depot/raid0/www/tikiwiki-1.9.3.1/
502       5462  0.0  0.0     0    0 ?        Z    Mar29   2:02 [gzip] <defunct>
502       6512  0.0  0.0     0    0 ?        Zs   Mar29   0:00 [backup_website_fil] <defunct>
502       6514  0.0  0.0  1852  796 ?        D    Mar29   0:03 tar -czPf /home/username/ARCHIVE/filegallery_20120329.tar.gz /depot/raid0/www/tikiwiki-1.9.3.1
502       6515  0.0  0.0     0    0 ?        Z    Mar29   2:02 [gzip] <defunct>
502       7858  0.0  0.0     0    0 ?        Zs   Mar30   0:00 [backup_website_fil] <defunct>
502       7860  0.0  0.0  1848  796 ?        D    Mar30   0:03 tar -czPf /home/username/ARCHIVE/filegallery_20120330.tar.gz /depot/raid0/www/tikiwiki-1.9.3.1
502       7861  0.0  0.0     0    0 ?        Z    Mar30   1:57 [gzip] <defunct>
502       9179  0.0  0.0     0    0 ?        Zs   Mar31   0:00 [backup_website_fil] <defunct>
502       9181  0.0  0.0  1852  792 ?        D    Mar31   0:03 tar -czPf /home/username/ARCHIVE/filegallery_20120331.tar.gz /depot/raid0/www/tikiwiki-1.9.3.1
502       9182  0.0  0.0     0    0 ?        Z    Mar31   1:57 [gzip] <defunct>
502      17447  0.0  0.0     0    0 ?        Zs   Apr01   0:00 [backup_website_fil] <defunct>
502      17449  0.0  0.0  1852  796 ?        D    Apr01   0:03 tar -czPf /home/username/ARCHIVE/filegallery_20120401.tar.gz /depot/raid0/www/tikiwiki-1.9.3.1
502      17450  0.0  0.0     0    0 ?        Z    Apr01   1:57 [gzip] <defunct>
502      18979  0.0  0.0     0    0 ?        Zs   Apr02   0:00 [backup_website_fil] <defunct>
502      18981  0.0  0.0  1848  792 ?        D    Apr02   0:03 tar -czPf /home/username/ARCHIVE/filegallery_20120402.tar.gz /depot/raid0/www/tikiwiki-1.9.3.1
502      18982  0.0  0.0     0    0 ?        Z    Apr02   1:44 [gzip] <defunct>
502      20376  0.0  0.0  2176  868 ?        Ss   Apr03   0:00 /bin/sh /home/username/scripts/backup_website_filegallery.sh
502      20378  0.0  0.0  1848  792 ?        D    Apr03   0:03 tar -czPf /home/username/ARCHIVE/filegallery_20120403.tar.gz /depot/raid0/www/tikiwiki-1.9.3.1
502      20379  0.0  0.0     0    0 ?        Z    Apr03   1:44 [gzip] <defunct>
502      22238  0.0  0.0  2176  864 ?        Ss   Apr04   0:00 /bin/sh /home/username/scripts/backup_website_filegallery.sh
502      22240  0.0  0.0  1848  792 ?        D    Apr04   0:03 tar -czPf /home/username/ARCHIVE/filegallery_20120404.tar.gz /depot/raid0/www/tikiwiki-1.9.3.1
502      22241  0.0  0.0     0    0 ?        Z    Apr04   1:48 [gzip] <defunct>
root     10961  0.0  0.0  3728  644 pts/2    R+   11:36   0:00 grep 502

MensaWater · 04-11-2012, 11:19 AM

To quote a famous HP-UX expert: You can't kill zombie processes - THEY'RE DEAD!

defunct = zombie

Zombies are processes that have lost contact with parent/child processes. While you can not kill a zombie SOMETIMES you can kill the parent and when it dies the zombie will go away too. The only sure fire way to get rid of zombies is to reboot.

You should do kill -9 as a last resort because it tells processes not to attempt any cleanup - just die and in fact it can cause zombies. Do progressive kill instead:
kill PID = Sends signal 15 to try to do orderly shutdown
kill -1 PID = Sends signal 1 to try to do sighup (this works for running shell processes when other kills don't).
kill -9 PID = Last resort.

It isn't unusual to see a few zombies running on occasion. (For example in one UNIX flavor every time you open a man page it has a defunct process associated with it that goes away when you exit man.) However, if you're seeing lots of them and they are increasing it is usually a good sign something else is going wrong and you should troubleshoot the cause rather than the effect.