Dealing with zombie processes under Linux

1. What is a zombie process

A zombie process means that its parent process has exited (the parent process did not wait (call wait/waitpid) for it), and if no process accepts the process after it dies, it becomes a zombie process, that is ( zombie) process.

2. How is the zombie process generated?

When a process calls the exit command to end its life, it is not actually destroyed, but leaves behind a process called a zombie process (Zombie) Data structure (the system call exit, its function is to make the process exit, but it is only limited to turning a normal process into a zombie process, and cannot completely destroy it).

　 Among the status of Linux processes, the zombie process is a very special kind. It has given up almost all memory space, does not have any executable code, and cannot be scheduled. It only retains a position in the process list to record the process. The exit status and other information can be collected by other processes. In addition, the zombie process no longer occupies any memory space. It needs its parent process to collect the corpse for it.

　If its parent process does not install the SIGCHLD signal processing function and calls wait or waitpid() to wait for the child process to end, and does not explicitly ignore the signal, then it will remain in the zombie state. If the parent process ends at this time, then init The process will automatically take over the child process and collect its corpse, and it can still be cleared.

　 But if the parent process is a loop and will not end, then the child process will remain in a zombie state. This is why there are sometimes many zombie processes in the system. The process numbers that can be used by the system are limited. If a large number of zombie processes are generated, the system will not be able to generate new processes because there are no available process numbers.

3. Avoidance of zombie processes

1. Parent The process waits for the child process to end through functions such as wait and waitpid, which will cause the parent process to hang. 2. If the parent process is very busy, you can use the signal function to install a handler for SIGCHLD, because after the child process ends, the parent process will receive This signal can be recycled by calling wait in the handler

　3. If the parent process does not care when the child process ends, then it can use signal(SIGCHLD, SIG_IGN) to notify the kernel that it is not interested in the end of the child process, then the child process ends. After that, the kernel will recycle and no longer send signals to the parent process

4. There are some tricks, that is, fork twice, the parent process forks a child process, and then continues to work, the child process forks a grandson process and then exits, then the grandchild The process is taken over by init. After the grandchild process ends, init will recycle it. However, you have to do the recycling of the child process yourself.

　 Why does the child process enter the zombie state after it ends?

　 Because the parent process may want to obtain the exit status and other information of the child process.

Is the zombie state a state that each child process passes through?

Any child process (except init) does not disappear immediately after exit(), but leaves behind a data called a zombie process (Zombie) structure (it occupies some memory resources, that is, there is still a record in the process table), waiting for processing by the parent process. This is the stage that every child process goes through at the end. If the child process does not have time to process after exit(), then you can use the ps command to see that the status of the child process is "Z".

　If the parent process can handle it in time, it may be too late to see the zombie state of the child process using the ps command, but this does not mean that the child process will not go through the zombie state.

　If the parent process exits before the child process ends, the child process will be taken over by init. init will process the child process in zombie state as the parent process.

4. How to view zombie processes

In Linux, using the command ps, you can see that the process marked Z is a zombie process.

　ps -ef|grep defunc can find zombie processes.

　You can use the -l option of ps to get more detailed process information. F (Flag): The sum of a series of numbers, indicating the current status of the process. The meaning of these numbers is:

　00: If displayed alone, it means that the process has been terminated.

　01: The process is part of the core process and resides in the system main memory. Such as: sched, vhand, bdflush, etc.

　02：Parent is tracing process.
　04：Tracing parent's signal has stopped the process; the parent　is waiting ( ptrace(S)).
　10: The process enters sleep state when the priority is lower than or equal to 25 and cannot Wake up with a signal, for example, when waiting for an inode to be created
　20: The process is loaded into the main memory (primary memory)
　40: The process is locked in the main memory and cannot be replaced before the transaction is completed

　 S (state of the process

　B: The process is waiting for more memory pages

　C: Estimated value of cpu utilization (cpu usage)




5. How to clear zombie processes

　1. Rewrite the parent process and collect the body of the child process after its death. The specific method is to take over the SIGCHLD signal. After the child process dies, the SIGCHLD signal is sent to the parent process. After receiving this signal, the parent process executes the waitpid() function to collect the corpse of the child process. This is based on the principle that even if the parent process does not call wait, the kernel will send it a SIGCHLD message. Although the default processing is to ignore it, if you want to respond to this message, you can set a processing function.

　 SIGCHLD signal: When the child process ends, the parent process will receive this signal. If the parent process does not handle this signal and does not wait for the child process, although the child process terminates, it will still occupy an entry in the kernel process table. At this time, the child process is called a zombie process. We should avoid this situation (the parent process either ignores the SIGCHILD signal, or catches it, or waits for the child process it derives, or the parent process terminates first, at which time the termination of the child process is automatically taken over by the init process).

　2. kill -18 PPID　(PPID is its parent process)

　This signal tells the parent process that the child process has died, please take back the resources allocated to him.

　 SIGCONT is also an interesting signal. As mentioned before, when the process is stopped, this signal is used to tell the process to resume running. The interesting thing about this signal is that it cannot be ignored or blocked, but it can be caught. The default behavior is to discard the signal.

　　３. Terminate the parent process

　If method 2 cannot be terminated, you can use the method of terminating its parent process (if its parent process is not needed). After the parent process dies, the zombie process becomes an "orphan process" and is adopted to process No. 1. init, init will always be responsible for cleaning up zombie processes. All zombie processes it spawned also disappeared.

　 First check if there are no other child processes in its parent process. If there are any, you may need to kill other child processes first, that is, sibling processes. The method is:

　Kill –15 PID1 PID2　(PID1 and PID2 are other child processes of the parent process of the zombie process).

　 Then kill the parent process: kill –15 PPID

　 In this way, the zombie process may be completely killed.

For more related articles on how to deal with zombie processes under Linux, please pay attention to the PHP Chinese website!