This question already has answers here:
How to kill zombie process
(9 answers)
Closed 9 years ago.
There are 2 zombie processes running in my server and I am unable to kill them with kill -9 command.
$ ps aux | awk '{ print $8 " " $2 }' | grep -w Z
Output:
Z 8511
Z 9002
Can someone please suggest me any other better way to kill them.
Thanks,
Sandeep.
Basically - you can't. And that's not necessarily a Bad Thing:
http://www.linuxsa.org.au/tips/zombies.html
Zombies are dead processes. You cannot kill the dead. All processes
eventually die, and when they do they become zombies. They consume
almost no resources, which is to be expected because they are dead!
The reason for zombies is so the zombie's parent (process) can
retrieve the zombie's exit status and resource usage statistics. The
parent signals the operating system that it no longer needs the zombie
by using one of the wait() system calls.
When a process dies, its child processes all become children of
process number 1, which is the init process. Init is ``always''
waiting for children to die, so that they don't remain as zombies.
If you have zombie processes it means those zombies have not been
waited for by their parent (look at PPID displayed by ps -l). You
have three choices: Fix the parent process (make it wait); kill the
parent; or live with it. Remember that living with it is not so hard
because zombies take up little more than one extra line in the output
of ps.
If you happen to know the parent, you can issue this command against the parent PID:
kill -s SIGCHLD pid
Related
This question already has answers here:
Kill all processes for a given user
(5 answers)
Closed 3 years ago.
I have a bunch of processes on my school's server that have been running for about a week without it being terminated. I found out that I could use "kill -9 [PID]" for each of the PIDs, but it took me awhile to individually kill each of them.
If, for instance, I have hundreds of processes I want to forcefully kill, is there a way to kill them all instantly?
You don't linux has number of commands, use the following with caution, killall or you could try pkill -U UID or pkill -U username
Note when using pkill, it will kill all processes including your tty terminal session if you are using SSH, you will be kicked out!
You can kill process by grep your applicationName. For example
ps aux |grep kpark06 | awk '{print $2}' | xargs sudo kill -9
man kill:
kill [options] [...]
<pid> can be a list. You can put a giant space-separated list of processes after kill, like kill 123 543.
A PID of -1 is special; it indicates all processes except the kill process itself
and init
So, kill -9 -1 will get everything, but that could easily be more than you expect. Having no idea what else is running there, I would only kill all the processes if prepared to restart the server.
If these processes have something in common, you may want killall, which can filter the processes to kill by age, user, and name/context regular expression, as well as asking for confirmation.
Tried with some examples like ps and ps -ef,after killing a process by using kill-9 PID in Linux,how to verify weather the process is killed or not?
Just run ps aux stat,pid again, and you will see the process with this pid is either a zombie ('Z' in the first column) or dead.
Edit:
Thanks, Mark B, for pointing me about zombies.
Ater the kill, check the PID of the process:
$ pidof PROCESS
You should see no output if the process is gone.
Another similar way:
$ ps aux | grep PROCESS
Notes:
You can kill your own process, but only root user can kill system process or another user process.
After you KILL the process you can get a zombie, you can still see it in the process list but with process STATE Z (wich means Zombie). Zombies cant be killed, they are already dead, so to "kill" zombies you need to kill the zombie's parents. That said, in general you don’t need to get rid of zombie processes unless you have a large amount of them.
I am writing one shell script in which I have parent process and it has child processes which are created by sleep & command. Now I wish to kill the parent process so that the child process will be also killed. I was able to do that this with below command:
trap "kill $$" SIGINT
trap 'kill -HUP 0' EXIT
trap 'kill $(jobs -p)' EXIT
These commands are working with kill [parent_process_ID] commands but if I use kill -9 [parent_process_ID] then only the parent process will be killed.
Please guide me further to achieve this functionality so that when I kill parent process with any command then child process should be also killed.
When you kill a process alone, it will not kill the children.
You have to send the signal to the process group if you want all processes for a given group to receive the signal.
kill -9 -parentpid
Otherwise, orphans will be linked to init.
Child can ask kernel to deliver SIGHUP (or other signal) when parent dies by specifying option PR_SET_PDEATHSIG in prctl() syscall like this:
prctl(PR_SET_PDEATHSIG, SIGHUP);
See man 2 prctl for details.
Sending the -9 signal (SIGKILL) to a program gives no chance for it to execute its own signal handlers (e.g., your trap statements). That is why the children don't get killed automatically. (In general, -9 gives no chance for the app to clean up after itself.) You have to use a weaker signal to kill it (such as SIGTERM.)
See man 7 signal for details.
If I want to strace a multi-threaded process (of all of its threads), how should I do it?
I know that one can do strace -f to follow forked process? But how about attaching to a process which is already multi-threaded when I start stracing? Is a way to tell strace to trace all of system calls of all the threads which belong to this process?
2021 update
strace -fp PID just does the right thing on my system (Ubuntu 20.04.1 LTS). The strace manual page points this out:
-f Trace child processes as they are created by currently traced processes as a result of the fork(2), vfork(2) and clone(2) system
calls. Note that -p PID -f will attach all threads of process PID if it is multi-threaded, not only thread with thread_id = PID.
Looks like this text was added back in 2013. If -f had this behavior on my system at the time, I didn't realize it. It does now, though!
Original 2013 answer
I just did this in a kludgy way, by listing each tid to be traced.
You can find them through ps:
$ ps auxw -T | fgrep program_to_trace
me pid tid1 ...
me pid tid2 ...
me pid tid3 ...
me pid tid4 ...
and then, according to man strace, you can attach to multiple pids at once:
-p pid Attach to the process with the process ID pid and begin tracing. The trace may be terminated at any time by a keyboard interrupt
signal (CTRL-C). strace will respond by detaching itself from the traced process(es) leaving it (them) to continue running. Mul‐
tiple -p options can be used to attach to up to 32 processes in addition to command (which is optional if at least one -p option is
given).
It says pid, but iirc on Linux the pid and tid share the same namespace, and this appeared to work:
$ strace -f -p tid1 -p tid2 -p tid3 -p tid4
I think that might be the best you can do for now. But I suppose someone could extend strace with a flag for expanding tids. There would probably still be a race between finding the processes and attaching to them in which a freshly started one would be missed. It'd fit in with the existing caveat about strace -f:
-f Trace child processes as they are created by currently traced processes as a result of the fork(2) system call.
On non-Linux platforms the new process is attached to as soon as its pid is known (through the return value of fork(2) in the par‐
ent process). This means that such children may run uncontrolled for a while (especially in the case of a vfork(2)), until the par‐
ent is scheduled again to complete its (v)fork(2) call. On Linux the child is traced from its first instruction with no delay. If
the parent process decides to wait(2) for a child that is currently being traced, it is suspended until an appropriate child
process either terminates or incurs a signal that would cause it to terminate (as determined from the child's current signal dispo‐
sition).
On SunOS 4.x the tracing of vforks is accomplished with some dynamic linking trickery.
As answered in multiple comments, strace -fp <pid> will show the trace of all threads owned by that process - even ones that process already has spawned before strace begins.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 5 years ago.
Improve this question
server01:/# ps -ax | grep java
Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html
7342 pts/3 Z 0:00 [java] <defunct>
7404 pts/3 S+ 0:00 grep java
server01:/# kill 7342
server01:/# ps -ax | grep java
Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html
7342 pts/3 Z 0:00 [java] <defunct>
7406 pts/3 S+ 0:00 grep java
server01:/#
In the above I am using ps command to know the pid of the java process which is 7342 in the above case.
Then I killed that process using kill command.
But that is not killed because again ps command shows java process with pid 7342.
Should I use some else command to kill the process and Why kill is not able to kill the process
Thanx
try
ps aux
then
kill -1 PID_NUMBER
to ask program to close itself, if it dosn´t answer you can force it to close
kill -9 PID_NUMBER
remember that using -9 to force program will finalize without asking and not saving anything
check: man kill
for more details
Linux supports the BSD style switches to the ps command (without the leading - ... dash/hyphen). If one supplies the hypen then the GNU coreutils version of ps (the one which is standard on mainstream Linux distributions) will attempt to interpret the switches as SysV compatible. This is the source of your error.
I'd recommend using the BSD form of the switches and look up the -o option to specify an output format consisting ONLY of the PID of the matching processes.
Also you're attempting to kill a zombie. As you've discovered that's a futile effort. A zombie is a placeholder in the process able for a process which is already dead. It remains in the process table until its parent process "reaps" its exit code. If the parent never does a wait() system call then the entry will stay there until after the parent is killed, at which point the zombie (and any other orphaned processes) will be inherited by the init process. The normal init under Linux (or any other form of UNIX) periodically reaps all dead processes (zombies).
Conceptually every process that exits on a UNIX/Linux system spends a small amount of time as a "zombie" ... that is there should always be a period of time between the process' termination and the time when some other process reads its exit value (even if only to discard it, as init does).
This question really should go on ServerFault
kill -9 can be used as a last resort to ensure the process dies.....
The process is listed as defunct. It's job is done and it's kept around because the parent process is still there. However, if the parent crashed or was killed by kill -9, there is no parent process, so the defunct process will kept around until reboot.
Defunct (or zombie) processes use only minimal resources, so you can keep them.
Solution: Either kill the parent or use kill -9 <pid>.
kill -9 $(pgrep -f keyword).
Kill pid(s) searched by 'KEYWORD';
kill $(pgrep [search pattern])
See if that works better. You have to be either root or the process owner to kill a process.
The java process has become a zombie process. You should try sending the SIGCHLD signal to the parent process via kill to tell the parent process to reap the zombie child process. Failing that, as mentioned by #Martin, you could kill the parent or kill -9 the zombie process.