Difference Between Orphan Processes and Zombie Processes

#unix #process

This article was originally published on bmf-tech.com.

Overview

While working with Docker, I learned about the existence of orphan processes, so I decided to investigate the differences between them and zombie processes.

What is a Zombie Process

A child process that has completed execution
Remains in the process table waiting for the parent process to perform a wait
Does not use system resources, but retains its PID
If many zombie processes accumulate, the available PIDs decrease, preventing other processes from starting
How to check for zombie processes
- Use ps aux to find processes with a stat of Z or those ending with defunct
- Use ps -ef | grep defunct to output only zombie processes
How to kill a zombie process
- Kill the parent process

Orphan Process

A process whose parent process has exited without performing a wait
Becomes a child process of the init process (PID 1), with the init process acting as the parent (foster parent)
How to check for orphan processes
- Use ps -elf | head -1; ps -elf | awk '{if ($5 == 1 && $3 != "root") {print $0}}' | head
How to kill an orphan process
- Use the kill command