It is a process that has completed execution but still has an entry in the process table, allowing the process that started it to read its exit status.
When a process ends, all of the memory and resources associated with it are de-allocated so they can be used by other processes. However, the process entry in the process table remains. The parent is sent a SIGCHLD signal indicating that a child has died; the handler for this signal will typically execute the
wait system call, which reads the exit status and removes the zombie.
The zombie’s process ID and entry in the process table can then be reused. However, if a parent ignores the SIGCHLD, it will be left in the process table. In some situations this may be desirable, for example if the parent creates another child process it ensures that it will not be allocated the same process ID.
A zombie process is not the same as an orphan process. Orphan processes don’t become zombie processes; instead, they are adopted by
init (process ID 1), which
waits on its children.
Zombies can be identified in the output from the UNIX ps command by the presence of a “Z” in the STAT column. Zombies that exist for more than a short period of time typically indicate a bug in the parent program. As with other leaks, the presence of a few zombies isn’t worrisome in it, but may indicate a problem that would grow serious under heavier loads.
To remove zombies from a system, the SIGCHLD signal can be sent to the parent manually, using the kill command. If the parent process still refuses to reap the zombie, the next step would be to remove the parent process. When a process loses its parent, init becomes its new parent. Init periodically will executes the
wait system call to reap any zombies with init as parent.