Nov 032009

A zombie, or defunct, process is a process that has terminated, but its parent process has not taken it out of the process table with the wait() family of system calls. This typically happens when a program forks/execs another program, but then doesn’t reap it properly. The easiest way to write the parent to properly reap its children is to setup a signal handler for SIGCHLD that calls wait().

See the man pages on your local system for signal and wait(2).

Zombie and defunct states of a process are different things. Zombie is created when a child dies and parent didn’t call wait. Defunct is created when parent dies before the child finishes.

Defunct processes can’t be killed since they are already dead. To make them disappear you have to kill their parent process…

It’s not possible to kill defunct processes.

A good way to kill lists of processes is:

$ ps axf | grep name-of-process | grep -v -grep | awk '{print "kill -9 ",$1}' | sh

Continue reading »

Jul 102008


This article is intended for use by any Unix/DBA Administrator who needs to monitor trace information from a UNIX process. For a more detailed look at the “truss” command using Sun Solaris, check out: (Using the “truss” command in Solaris)

How to Trace Unix System Calls for a Process

The following platforms support a trace utility that can be used to identify what a process is doing:

O/S Version Trace Utility
Sun Solaris 2.x, Unixware 7.0
truss, e.g.:

  Unixware 7.0
    $ truss -aefo <output file> <executable>

    $ truss -rall -wall -p <UNIX pid>
HP/UX 11
tusc, e.g.:
  $ tusc -afpo <output file> <pid> <executable>
sctrace, e.g.:
  $ sctrace -Amo <output file> <executable>
strace, e.g.:
  $ strace -fo <output file> <executable>
  $ strace -p <UNIX pid>
par, e.g.:
  $ par -siSSo <output file> <executable>
Compaq Tru64 Unix
trace, e.g.:
  $ trace -fo <output file> <executable>
Sequent Dynix/PTX
truss, e.g.:
  $ truss -aefo <output file> <executable>