如何找到并杀掉 Linux 系统中的僵尸进程
僵尸进程
![](/data/attachment/album/202110/25/110222ygkl8gutsl8s6o6l.jpg)



> 
> 这是一个关于如何寻找 Linux 系统僵尸进程并杀死它们的小知识。你也可以从中了解到关于进程和僵尸进程的一些知识。
> 
> 
> 


在了解僵尸进程之前，让我们来复习一下什么是 Linux 进程。


简而言之，[进程](https://tldp.org/LDP/tlk/kernel/processes.html) 是一个程序的运行实例。它可能运行在前端（比如有交互的进程），也可能运行在后端（比如无交互或自动运行的进程）。它可能是一个父进程（运行期间创建了其他进程），也可能是一个子进程（由其他进程所创建）。


在 Linux 系统中，除 PID 为 0 的第一个 `init` 进程（或 `systemd`）外，其余进程都有父进程。进程也可以拥有自己的子进程。


不相信？可以试试在终端中使用 `pstree` 命令查看进程的树型结构，你能看到系统各个进程的“家族树”。


### Linux系统里的僵尸进程是什么？


子进程死亡后，它的父进程会接收到通知去执行一些清理操作，如释放内存之类。然而，若父进程并未察觉到子进程死亡，子进程就会进入到“<ruby> 僵尸 <rt>  zombie </rt></ruby>”状态。从父进程角度看，子进程仍然存在，即使子进程实际上已经死亡。这就是“<ruby> 僵尸进程 <rt>  zombie process </rt></ruby>”（也被称为“<ruby> 已消失进程 <rt>  defunct process </rt></ruby>”）是如何产生并存在于系统中的。


这里有一个来自 [Turnoff.us](https://turnoff.us/geek/zombie-processes/) 的关于僵尸进程的非常有趣的看法：


![Image credit: Turnoff.us](/data/attachment/album/202110/25/110223e8pmlipzlfuj3fc8.jpg)


### 你真的需要关心僵尸进程吗？


重点要说的是，僵尸进程并没有像它的名称那样看起来可怕。


但如果系统的内存已经所剩不多或者有太多的僵尸进程在吃掉内存，问题会变得糟糕。同样，大部分 Linux 系统进程最大 PID 设置为 32768，如果过多僵尸进程导致其他重要任务没有 PID 可用，你的系统会发生崩溃。


这是真实可能发生的，它有一定的概率，特别当存在一个编码糟糕的程序开始大量产生僵尸进程的时候。


在这种情况下，找到并杀死僵尸进程是一个明智的做法。


### 如何找到僵尸进程


Linux 系统中的进程可能处于如下状态中的一种：


* `D` = 不可中断的休眠
* `I` = 空闲
* `R` = 运行中
* `S` = 休眠
* `T` = 被调度信号终止
* `t` = 被调试器终止
* `Z` = 僵尸状态


那如何查看进程和它的当前状态呢？一个简单的方法是在终端中使用 [top 命令](https://linuxhandbook.com/top-command/)。


![Top command show processes and their status](/data/attachment/album/202110/25/110223ofb9ha7vf65eeqbe.png)


正如你在上面截图中看到的，截图中共有 250 个任务（进程），其中 1 个处在 “<ruby> 运行中 <rt>  running </rt></ruby>” 状态，248 个进程处于 “<ruby> 休眠 <rt>  sleep </rt></ruby>” 状态，还有一个处于 “<ruby> 僵尸 <rt>  zombie </rt></ruby>” 状态。


现在问题进入下一步，如何杀死 “僵尸” 进程？


### 如何找到并杀死一个僵尸进程？僵尸进程能被杀死吗？


僵尸进程已经死了，要如何才能杀死一个已经死亡的进程呢？


在僵尸电影中，你可以射击僵尸的头部或烧掉它们，但在这里是行不通的。你可以一把火烧了系统来杀死僵尸进程，但这并不是一个可行的方案。


一些人建议发送 `SIGCHLD` 给父进程，但这个信号很可能会被忽略。还有一个方法是杀死父进程来杀死僵尸进程，这听起来很野蛮，但它却是唯一能确保杀死僵尸进程的方法。


首先，通过在终端中 [使用 ps 命令](https://linuxhandbook.com/ps-command/) 我们列举僵尸进程，得到它们的进程 ID：



```
ps ux | awk '{if($8=="Z+") print}'

```

`ps ux` 命令输出的第 8 列显示了进程状态。上述命令只会打印所有处在 Z+ 状态（表示僵尸状态）的进程。


确认了进程 ID 后，我们可以得到它的父进程 ID：



```
ps -o ppid= -p <child_id>

```

你也可以将上述两个命令结合在一起，直接得到僵尸进程的 PID 及其父进程的 PID：



```
ps -A -ostat,pid,ppid | grep -e '[zZ]'

```

现在你得到了父进程 ID，使用命令行和得到的 ID 号 [终于可以杀死进程了](https://itsfoss.com/how-to-find-the-process-id-of-a-program-and-kill-it-quick-tip/)：



```
kill -9 <parent_process_ID>

```

![Killing parent process](/data/attachment/album/202110/25/110224zd2sx1odn2n747x2.png)


再次运行 `ps` 命令或 `top` 命令，你可以验证僵尸进程是否已经被杀死。


恭喜！现在你知道怎么清理僵尸进程了。




---


via: <https://itsfoss.com/kill-zombie-process-linux/>


作者：[Marco Carmona](https://itsfoss.com/author/marco/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[zengyi1001](https://github.com/zengyi1001) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
![Warp Terminal](/assets/images/warp-terminal.webp)


![Warp Terminal](/assets/images/warp-terminal.webp)

Before you learn about Zombie process, let me recall what is a process in Linux.

In a few words, a [process](https://tldp.org/LDP/tlk/kernel/processes.html?ref=itsfoss.com) is a running instance of a program in performance. It can be foreground (interactive process) or background (not interactive or automatic process). It can be a parent (creator of other processes during run-time) or child (process created by others) process.

In Linux, except for the first init (or systemd) process with PID 0, every other process has a parent process. Processes also have their own child processes.

Don’t believe me? Use the `pstree`

command in terminal to look at the process tree to see the ‘family tree’ of your system’s processes.

## What is a Zombie process in Linux?

When a child process dies, the parent process is informed so that it can do some clean up like freeing up memory etc. However, child process goes into zombie state if the parent process is not aware of its death. For the parent, the child still exists but the child process is actually dead. This is how zombie processes (also known as defunct processes) are created and stay in the system.

Here’s an excellent funny take on the zombie process by Turnoff.us:

![zombies turnoff](https://itsfoss.com/content/images/wordpress/2021/10/zombies-turnoff-800x467.webp)

[Turnoff.us](https://turnoff.us/geek/zombie-processes/?ref=itsfoss.com)

## Do you really need to worry about Zombie processes?

Here is important to say that zombie processes are not as dangerous as its name can sound.

The problem may arise if your system has limited RAM or if there are too many zombie processes eating up RAM. Also, most Linux processes can have maximum PID set to 32768. If there are no available IDs for other productive tasks, your system may crash.

This rarely happens, but it’s a possibility, specially if a poorly coded program starts inducing numerous zombie processes.

In such case, it would be a good idea to find and kill zombie process.

## How to find zombie processes?

A process in Linux can have one of the following states:

- D = uninterruptible sleep
- I = idle
- R = running
- S = sleeping
- T = stopped by job control signal
- t = stopped by debugger during trace
- Z = zombie

But where can you see the processes and their respective status? One easy way is to use the terminal and the [top command](https://linuxhandbook.com/top-command/?ref=itsfoss.com).

![top command view](https://itsfoss.com/content/images/wordpress/2021/10/top-command-view-800x474.png)

As you can see in the screenshot above, there are 250 total tasks (or processes), 1 is running, 248 processes are sleeping and 1 is in zombie state.

Now, the question arises, how to kill the zombie process?

## How to find and kill a zombie process? Can a zombie process be killed?

A zombie process is already dead. How do you kill an already dead process?

In the zombie movies, you shoot the zombies in the head or burn it. That’s not an option here. You can burn your system for killing the zombie process but that’s not a feasible solution ;)

Some people suggests sending SIGCHLD signal to the parent process. But it is more likely to be ignored. The other option to kill the zombie process is to kill its parent process. That sounds brutal but that’s the only sure shot way of killing zombie processes.

So, first, let’s list the zombie processes to know their ID. It can be achieved by [using the ps command](https://linuxhandbook.com/ps-command/?ref=itsfoss.com) like this in the terminal.

`ps aux | awk '$8 ~ /^[Zz]/'`


The 8th column in the output of the ps aux command displays the state of a process. You are asking to print all the matching lines where the state of a process starts with Z or z.

Once you have identified its process ID, let’s get its parent’s process ID.

`ps -o ppid= -p <child_id>`


Alternatively, you can combine the above two commands in the following fashion where it directly provides the PID of the zombie process and the PID of its parent process.

`ps -A -ostat,pid,ppid | grep -e '[zZ]'`


Here you get the parent process ID, so [finally kill the process](https://itsfoss.com/how-to-find-the-process-id-of-a-program-and-kill-it-quick-tip/) by typing the command line with its respective ID process obtained before.

`kill -9 <parent_process_ID>`


![killing parent process](https://itsfoss.com/content/images/wordpress/2021/10/killing-parent-process-800x180.png)

You can verify if the zombie process is killed or not by running the ps command again or even the top command.

Congrats! Now you know how to eliminate zombie processes.