What is a Defunct (Zombie) Process
To understand what a defunct process (sometimes known as a zombie process) is, let us take a look at how processes work. We shall look at processes on Solaris as an example. When a program is run within a shell, the shell starts a new process to carry out the work.
A defunct, or Zombie process, is just that, a process information block that is waiting for the parent process to clean it up. While defunct processes do not take up any CPU time, RAM or IO, it does consume a process information block, a limited resource.
The “zombie” name comes from the status entry which should be a “Z”. Since the process has essentially exited, information regarding the name of the program is no longer available, so the “zombie” name is used indicating it’s dead and gone. Here is sample output of ps output showing a defunct process in the kernel’s process table:
# ps -ef | grep defunct root 12610 1 0 - ? 0:00 <defunct>
Killing defunct Process on Solaris 8 and below
In Solaris 8 and older version of the Operating systems, it is necessary to reboot to clear defunct and/or zombie processes.
Killing Defunct Process on Solaris 9 and higher
In Solaris 9 and higher, the preap command can kill defunct processes. The preap command should be used only in situations in which the administrator or developer has confirmed that defunct processes will not be reaped by the parent process. Otherwise, preap may damage the parent process in unpredictable ways.
# preap 12610 12610: exited with status 0
Conclusion
By design, processes will not completely exit until the parent has picked up their exit status. If there are lots of zombie processes on the system, examine the ps output and see what the parent process ID is. It’s the responsibility of the parent to identify all children who have exited and obtain the status even though the parent doesn’t want to do anything with it.
Once the parent process exits, all of its children are moved to init. The ultimate root of this tree of processes is PID 1 (the init process). If init inherits a zombie process, the process will be “reaped” or removed from the process table as one of the tasks of init is to wait for (and discard) the exit status of zombies.