[EXPLAINED] My zombie process

[Snowhog]

For awhile now, when booting into my system (Karmic 9.10 (kernel 2.6.31-20-generic) running KDE 4.4.1, a zombie process gets created. I don't know for sure how long this has been occurring, but it wasn't happening before. A single zombie process is reported, and it's always from dhclient:

top - 10:20:00 up 1:34, 2 users, load average: 0.00, 0.00, 0.05
Tasks: 173 total,  3 running, 168 sleeping,  1 stopped,  [color=red]1 zombie[/color]
Cpu(s): 12.4%us, 5.1%sy, 0.0%ni, 82.3%id, 0.0%wa, 0.1%hi, 0.0%si, 0.0%st
Mem:  2052252k total, 1208372k used,  843880k free,  107684k buffers
Swap: 2096440k total,    0k used, 2096440k free,  732032k cached

paul@myotherbrain:~$ zombies
[sudo] password for paul: 
F S UID    PID PPID C PRI NI ADDR SZ WCHAN STIME TTY     TIME CMD
4 Z root   2070 1643 0 80  0 -   0 exit  08:45 ?    00:00:00 [[color=red]dhclient[/color]] <defunct>
0 R paul   20351 20330 0 80  0 -  761 -   10:17 pts/1  00:00:00 grep --color=auto Z

It's simple enough to kill it:

sudo kill -9 ppid

where ppid equals the reported PPID by top.

Why is this zombie being created? What is it about dhclient that is causing it? How can I prevent dhclient from producing this zombie?

[johnrobert]

Re: My zombie process

I have the same thing happening on KDE 4.3.2, running Karmic 9.10 with the same kernel as you.

[kubicle]

Re: My zombie process

Why is this zombie being created?

Are you using wicd? wicd-daemon can (at least in some conditions) leave a zombie dhclient process.

What is it about dhclient that is causing it?

It's not a problem with dhclient, a zombie process has done it's job (and is no longer running), but the parent has not read it's exit status (creating the zombie)...this is commonly a bug in the parent process.

How can I prevent dhclient from producing this zombie?

There is usually not much you can do...other than file a bug report. Luckily a zombie process is really nothing more than an entry in the process table, it shouldn't affect your machine or eat your resources (as a zombie process isn't really running).

[Snowhog]

Re: My zombie process

Thank you.

"Are you using Wicd?" Yes.

"It's not a problem with dhclient,..." Okay.

"...this is commonly a bug in the parent process." Good to know.

"...it shouldn't affect your machine or eat your resources..." Yes, I'm aware of that.

Okay, so Wicd is (here) the 'zombie generator.' Identifying it/them is easy enough, and I check for them after each reboot. Killing them is also easy.

[kyonides]

Re: [EXPLAINED] My zombie process

I had a similar issue with avg after I installed it (just to make sure Windows users that will download some scripted games I offer won't get attack by any virus) and upgraded to KDE 4.4.1. Before, when I had 4.3.2 installed on my KK system it never happened... Actually with 4.4.1 I found not just one process but a kind of single process multiplied by dozens...

[GreyGeek]

Re: [EXPLAINED] My zombie process

mmmm.... I took a look and noticed zombies on both wicd AND on FireFox. I used the "Kill Process" button in ksysguard to kill the zombies BUT they refused to go away. I opened ksysguard in a konsole using sudo and tried to kill them, but they refused to go away. So, I issued "sudo kill -9 1586" (for the wicd zombie) and that WOULD NOT kill it! I couldn't kill the FireFox zombie at the CLI as root either. I closed FireFox and the zombie went away. I didn't want to close wicd to make its zombie go away, but it appears that, in a 64 bit Kubuntu Lucid Lynx, a zombie cannot be removed until the parent PID closes or is terminated.

The only resource that appears to be used is the PID number, which is no big deal.

[kubicle]

Re: [EXPLAINED] My zombie process

So, I issued "sudo kill -9 1586" (for the wicd zombie) and that WOULD NOT kill it!

Since the (zombie) process is already dead, it cannot receive any signals from kill, you have to "target" the parent. Of course, there's normally no demanding reason to remove zombies.

More on zombies: http://en.wikipedia.org/wiki/Zombie_process

[tnorris]

Re: [EXPLAINED] My zombie process

In order to understand what's happening here you have to understand a bit about multi-process programming an a unix environment. When a parent process creates a child process via fork() that child runs until it calls exit(). Once the child process has called exit() the parent process can get the success/failure information from the child process by calling wait(). This way the parent process can be informed of what happened in the child process.

A zombie process is a child process that has called exit() but whose parent process has not yet called wait(). Unix can't let the process go away because it still has information to provide (the sucess/failure information) but it can't continue to execute because it's called exit(). So, it becomes a zombie.

There's a whole lot more to it than that, but that's the 30 second overview.

In this specific example. WICD created a dhclient child process (probably to get the ip address on a new connection) and once dhclient got the ip address it tried to inform WICD of it's success/failure but WICD never (or at least, has not yet) asked.

The process will remain a zombie until WICD issues it's wait() call, or the WICD process is killed at which point the init process will issue a wait() call on it (since it's the parent of all processes).

It's a WICD bug.

[GreyGeek]

Re: [EXPLAINED] My zombie process

......
In this specific example. WICD created a dhclient child process (probably to get the ip address on a new connection) and once dhclient got the ip address it tried to inform WICD of it's success/failure but WICD never (or at least, has not yet) asked.
.....

This appears to explain why, when my desktop appears, the YAWP weather plasmoid continues to spin it's "busy" wheel for several seconds and then displays a "cached" on its display without updating the weather information. It must be trying to communicate to the weather site via the wicd zombie. When I "refresh", or open the configure dialog and immediately close it, YAWP fetches the weather info and displays it.

BTW, I hadn't paid any attention to zombies for years but I do recall a period, at least 8 to 10 years ago, when zombies were created in droves on the distro I was using. (It was probably a late 5.x or early 6.x SuSE distro and the old 2.2 kernel). One COULD delete them using the kill command. So, when SnowHog reported that they were easily killed using the "kill -9 ppid" command I wasn't surprise ... until I tried it and it didn't work.

[Adrian]

Re: [EXPLAINED] My zombie process

Distrowatch has a nice explanation about zombie processes: http://distrowatch.com/weekly.php?issue=20100301#qa

[kubicle]

Re: [EXPLAINED] My zombie process

So, when SnowHog reported that they were easily killed using the "kill -9 ppid" command I wasn't surprise ... until I tried it and it didn't work.

Note that Snowhog used PPID (parent process ID), not PID (process ID)

[Snowhog]

Re: [EXPLAINED] My zombie process

Yes. To kill a zombie, you have to use the PPID number. In my code example, I used PPID to indicate that it's the PPID number and not the PID number you must use.

[GreyGeek]

Re: [EXPLAINED] My zombie process

Well, that's no good.

One might as well kill the pid of the parent.

[kubicle]

Re: [EXPLAINED] My zombie process

One might as well kill the pid of the parent.

Yes, it is exactly the same. It is not always necessary to kill the parent, one can try to send the parent the SIGCHLD signal (instead of SIGKILL) to try to make it "reap" it's children, but SIGKILL is the only way that (I know of) guarantees the zombie will be reaped.

BTW, I hadn't paid any attention to zombies for years but I do recall a period, at least 8 to 10 years ago, when zombies were created in droves on the distro I was using. (It was probably a late 5.x or early 6.x SuSE distro and the old 2.2 kernel). One COULD delete them using the kill command.

I'd gladly hear more details if you can recollect them, since I've never had any success sending signals to zombies directly (which by the definition of zombies should be impossible), and I think the system has been pretty much the same since the early versions of unix. I'm by no means saying your recollections must be wrong, I just consider this an opportunity to learn more.

Are you sure your problem processes were zombies (and not orphans or other "misbehaving" processes)?

[oshunluvr]

Re: [EXPLAINED] My zombie process

You guys - EVERYONE knows to kill a zombie; you have to shoot them in the head...just don't let them bite you!


Sorry, I couldn't resist any longer!