1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

/**
 * Simplified kernel exit sequence (based on kernel/exit.c)
 * Shows what happens when a process terminates
 */
 
void do_exit(long code)
{
    struct task_struct *tsk = current;
    
    /*
     * Phase 1: Release resources
     * Process is still TASK_RUNNING during this phase
     */
    
    exit_signals(tsk);        /* Handle pending signals */
    exit_mm(tsk);             /* Release memory mappings */
    exit_files(tsk);          /* Close open file descriptors */
    exit_fs(tsk);             /* Release filesystem context */
    exit_thread(tsk);         /* Clean up thread-specific data */
    exit_task_namespaces(tsk);/* Exit namespaces */
    
    /*
     * Phase 2: Notification and reparenting
     */
    
    exit_notify(tsk);        /* Notify parent, reparent children */
    
    /*
     * Phase 3: Become a zombie
     * This is the critical transition
     */
    
    tsk->exit_state = EXIT_ZOMBIE;
    tsk->exit_code = code;    /* Store exit status */
    
    /* Record resource usage for parent to read later */
    tsk->utime;               /* User CPU time */
    tsk->stime;               /* System CPU time */
    tsk->min_flt;             /* Minor page faults */
    tsk->maj_flt;             /* Major page faults */
    /* ... other accounting info ... */
    
    /*
     * Phase 4: Schedule away forever
     * This process will never run again
     */
    
    schedule();               /* Give up CPU - never returns */
    BUG();                    /* Should never reach here */
}
 
/*
 * Called by parent's wait() - reaps the zombie
 */
void release_task(struct task_struct *p)
{
    /* Final cleanup - only runs after wait() */
    p->exit_state = EXIT_DEAD;
    
    /* Free the task_struct and release PID */
    put_task_struct(p);
    
    /* PID can now be reused by new processes */
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

#!/bin/bash
# Analyze zombie resource consumption
 
echo "=== Zombie Analysis ==="
 
# Count zombies
zombie_count=$(ps aux | awk '$8 ~ /^Z/ {count++} END {print count+0}')
echo "Total zombie processes: $zombie_count"
 
# Calculate approximate memory usage
# task_struct is roughly 1-2KB in kernel memory
approx_mem=$((zombie_count * 2))
echo "Approximate kernel memory used: ~${approx_mem}KB"
 
# Check PID limits
max_pid=$(cat /proc/sys/kernel/pid_max)
current_pids=$(ls /proc | grep -E '^[0-9]+$' | wc -l)
echo "PID limit: $max_pid"
echo "Current processes: $current_pids"
echo "PIDs consumed by zombies: $zombie_count"
 
# Show the actual zombies
if [ "$zombie_count" -gt 0 ]; then
    echo ""
    echo "=== Zombie Processes ==="
    ps aux | awk 'NR==1 || $8 ~ /^Z/'
    
    echo ""
    echo "=== Zombie Parents ==="
    ps aux | awk '$8 ~ /^Z/ {print $2}' | while read zpid; do
        ppid=$(awk '{print $4}' /proc/$zpid/stat 2>/dev/null)
        if [ -n "$ppid" ]; then
            echo "Zombie PID $zpid -> Parent PID $ppid"
            ps -p $ppid -o pid,cmd 2>/dev/null
        fi
    done
fi

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

#!/bin/bash
# Multiple methods to identify zombie processes
 
echo "=== Method 1: ps with state filter ==="
# The 'Z' state indicates zombie
ps aux | awk 'NR==1 || $8 ~ /^Z/'
# Output columns: USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
# STAT 'Z' or 'Z+' = zombie
 
echo ""
echo "=== Method 2: ps with explicit format ==="
ps -eo pid,ppid,stat,cmd | grep -E '(^[[:space:]]*PID|Z)'
 
echo ""
echo "=== Method 3: Check /proc directly ==="
for pid in /proc/[0-9]*; do
    if [ -f "$pid/stat" ]; then
        state=$(awk '{print $3}' "$pid/stat")
        if [ "$state" = "Z" ]; then
            basename "$pid"
            cat "$pid/stat"
        fi
    fi
done
 
echo ""
echo "=== Method 4: Using the 'defunct' keyword ==="
# Zombie processes show '<defunct>' in ps output
ps aux | grep '<defunct>'
 
echo ""
echo "=== Method 5: Quick count ==="
echo "Zombie count: $(ps aux | awk '$8 ~ /^Z/ {count++} END {print count+0}')"
 
echo ""
echo "=== Method 6: top command ==="
echo "Press 'q' to exit"
# In top, look for 'zombie' in the summary line:
# Tasks: 256 total, 1 running, 252 sleeping, 0 stopped, 3 zombie
top -bn1 | head -5

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

/**
 * Demonstration: Creating and observing a zombie process
 * Compile: gcc -o create_zombie create_zombie.c
 * Run: ./create_zombie
 * 
 * While running, use another terminal to observe:
 *   ps aux | grep -E 'create_zombie|defunct'
 */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>
 
int main(void) {
    pid_t child_pid;
    
    printf("=== Zombie Process Demonstration ===\n\n");
    printf("Parent PID: %d\n", getpid());
    
    child_pid = fork();
    
    if (child_pid < 0) {
        perror("fork failed");
        exit(EXIT_FAILURE);
    }
    
    if (child_pid == 0) {
        /* Child process */
        printf("Child: PID %d starting...\n", getpid());
        printf("Child: Doing some work...\n");
        sleep(2);
        printf("Child: Work complete. Exiting with status 42.\n");
        
        /* Child exits but parent doesn't call wait() */
        /* This creates a zombie */
        exit(42);
    }
    
    /* Parent process */
    printf("Parent: Created child with PID %d\n", child_pid);
    printf("\nParent: Child will exit in ~2 seconds and become a zombie.\n");
    printf("Parent: I will NOT call wait(), so child stays zombie.\n");
    printf("\n>>> Open another terminal and run: ps aux | grep %d\n", child_pid);
    printf(">>> You'll see the child in 'Z' (zombie) state\n\n");
    
    /* Wait long enough to observe the zombie */
    printf("Parent: Sleeping for 30 seconds (observe the zombie)...\n");
    sleep(30);
    
    /* Now reap the zombie */
    printf("\nParent: Now calling wait() to reap the zombie...\n");
    
    int status;
    pid_t reaped = waitpid(child_pid, &status, 0);
    
    if (reaped == child_pid) {
        if (WIFEXITED(status)) {
            printf("Parent: Successfully reaped PID %d\n", reaped);
            printf("Parent: Child exited with status: %d\n", WEXITSTATUS(status));
        } else if (WIFSIGNALED(status)) {
            printf("Parent: Child was killed by signal: %d\n", WTERMSIG(status));
        }
    }
    
    printf("\nParent: Zombie has been reaped. Check ps again - it's gone!\n");
    sleep(5);
    
    printf("Parent: Demonstration complete.\n");
    return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

/**
 * Demonstrates complete exit status interpretation
 * Shows all information preserved by zombies
 */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>
#include <sys/resource.h>
 
void print_exit_status(int status) {
    printf("\n=== Exit Status Analysis ===\n");
    printf("Raw status value: 0x%04X (%d)\n", status, status);
    
    if (WIFEXITED(status)) {
        /* Normal exit via exit() or return from main */
        printf("Termination: NORMAL EXIT\n");
        printf("Exit code: %d\n", WEXITSTATUS(status));
        
        if (WEXITSTATUS(status) == 0) {
            printf("Interpretation: SUCCESS\n");
        } else {
            printf("Interpretation: FAILURE (code %d)\n", WEXITSTATUS(status));
        }
    }
    
    if (WIFSIGNALED(status)) {
        /* Killed by a signal */
        printf("Termination: KILLED BY SIGNAL\n");
        printf("Signal number: %d\n", WTERMSIG(status));
        
        /* Common signals */
        int sig = WTERMSIG(status);
        switch (sig) {
            case 2:  printf("Signal name: SIGINT (Ctrl+C)\n"); break;
            case 6:  printf("Signal name: SIGABRT (abort)\n"); break;
            case 9:  printf("Signal name: SIGKILL (kill -9)\n"); break;
            case 11: printf("Signal name: SIGSEGV (segfault)\n"); break;
            case 15: printf("Signal name: SIGTERM (terminate)\n"); break;
            default: printf("Signal name: (other)\n"); break;
        }
        
        #ifdef WCOREDUMP
        if (WCOREDUMP(status)) {
            printf("Core dump: YES (core file generated)\n");
        } else {
            printf("Core dump: NO\n");
        }
        #endif
    }
    
    if (WIFSTOPPED(status)) {
        printf("Termination: STOPPED (not dead)\n");
        printf("Stop signal: %d\n", WSTOPSIG(status));
    }
    
    #ifdef WIFCONTINUED
    if (WIFCONTINUED(status)) {
        printf("Status: CONTINUED (resumed after stop)\n");
    }
    #endif
}
 
void print_resource_usage(struct rusage *usage) {
    printf("\n=== Resource Usage (from zombie) ===\n");
    printf("User CPU time: %ld.%06ld seconds\n",
           usage->ru_utime.tv_sec, usage->ru_utime.tv_usec);
    printf("System CPU time: %ld.%06ld seconds\n",
           usage->ru_stime.tv_sec, usage->ru_stime.tv_usec);
    printf("Max resident set size: %ld KB\n", usage->ru_maxrss);
    printf("Minor page faults: %ld\n", usage->ru_minflt);
    printf("Major page faults: %ld\n", usage->ru_majflt);
    printf("Voluntary context switches: %ld\n", usage->ru_nvcsw);
    printf("Involuntary context switches: %ld\n", usage->ru_nivcsw);
}
 
int main(void) {
    pid_t child = fork();
    
    if (child == 0) {
        /* Child: do some work then exit */
        volatile long sum = 0;
        for (long i = 0; i < 100000000; i++) sum += i;
        exit(42);  /* Exit with code 42 */
    }
    
    /* Parent: collect full information using wait4() */
    int status;
    struct rusage usage;
    
    /* wait4() retrieves both status and resource usage */
    pid_t reaped = wait4(child, &status, 0, &usage);
    
    printf("Reaped child PID: %d\n", reaped);
    print_exit_status(status);
    print_resource_usage(&usage);
    
    return 0;
}