Linux Interview Question 2: Zombie Process Reaping
Linux Interview Questions · Test 1 · question 2 of 10
On a busy host, ps -eo pid,ppid,stat,cmd shows several hundred entries in state Z marked <defunct>. All of them have the same parent PID, 2210, which belongs to a long-running job dispatcher. A colleague ran sudo kill -9 on a handful of the defunct PIDs, and they are still listed.
What will actually remove these entries from the process table?
Show answer and explanation
Answer:
A zombie is a child that has already terminated but whose parent has not yet called wait() (or waitpid() and friends) to collect its exit status. The kernel keeps only a minimal record (PID, termination status, resource usage) so the parent can retrieve it later. Each record uses a process-table slot, and if slots run out no new processes can be created. The zombie is already dead, so the fix is on the parent: fix or signal the dispatcher so it reaps its children, or terminate it. When a parent dies, its zombie children are re-parented to init (or the nearest subreaper), which automatically waits on them and removes them.
Option A is wrong because there is nothing left to kill. A zombie executes no code, so no signal, not even SIGKILL as root, changes its state. Only a wait() by its parent removes it.
Option B is wrong because drop_caches frees clean page cache and slab objects. Zombies have already released their memory, and that has nothing to do with the process-table entry.
Option C is wrong because SIGCONT resumes a *stopped* process (state T). A zombie has already finished exit(); there is nothing to resume.
Reference: wait(2) - Linux manual page