Find defunct processes fast and learn how to make the parent reap them. 16.11.2025 | reading time: 2 min A zombie is a process that has exited but still appears in the process table because its parent did not call wait; this short guide shows how to spot such defunct entries with real commands and a reproducible example. Reproduce and Observe Create a tiny test to see a zombie live; compile and run the child-exit parent-sleeps example and inspect the table with `ps`: ```c #include <unistd.h> #include <sys/types.h> #include <stdlib.h> #include <stdio.h> int main(void) { pid_t pid = fork(); if (pid == -1) { perror("fork"); exit(1); } if (pid == 0) { exit(0); } sleep(30); return 0; } ``` ```sh gcc -o zombie zombie.c ./zombie & ps -o pid,ppid,state,cmd | grep zombie # example output: # 12346 12345 Z ./zombie <defunct> ``` What the Z means The single-letter state Z marks a defunct process; it consumes almost no CPU and no memory pages but keeps a PID and an entry until the parent calls wait; if the parent never reaps the child he must be fixed or restarted, otherwise the system can exhaust available PIDs under heavy churn. Diagnose and resolve First find the zombie PID and its parent PID with `ps` or `pstree`, then inspect the parent to see why it did not reap children; often the remedy is to fix the parent to call wait, send SIGCHLD to prompt reaping, or restart the parent service so init can adopt and clean up the defunct entry. Quick tool recommendations Use interactive viewers to spot many zombies, use tracers for insight into parent behavior, and use lightweight commands to script scans across servers for monitoring and alerting. Next steps You now know how to recreate, detect and reason about zombie processes; pursue deeper troubleshooting techniques and consider studying for certifications like CompTIA Linux+ or LPIC-1 to solidify these skills, and use bitsandbytes.academy for intensive exam preparation. Join Bits & Bytes Academy First class LINUX exam preparation. processes troubleshooting utilities
