Frequently Asked Question

What is a zombie process and why is it harmless?

A zombie (or "defunct") process is one that has finished running but whose parent has not yet called wait() to collect its exit status. The kernel keeps a tiny stub of the dead process, its PID, exit code, resource usage, in the process table so the parent can read it. The stub holds no memory, no open files, and no CPU time; it is essentially a death certificate waiting to be filed. You see them in ps with state Z and a command name in angle brackets like <defunct>.

Zombies are harmless individually, but a programming bug that produces millions of them can exhaust the PID space and stop the system from creating new processes. The fix is in the parent: it should either call wait()/waitpid() for each child, set a SIGCHLD handler that reaps them, or use signal(SIGCHLD, SIG_IGN) to ask the kernel to auto-reap. You cannot kill a zombie, it is already dead, but if you kill its parent, PID 1 inherits it and reaps it immediately.