This content has been marked as final. Show 4 replies
Sometimes you get a zombie process because the parent is killed before the child, and the child has no parent to tell it has finished. At least in older hp-ux&oracle, I don't recall seeing it recently. There also could be some driver problem. Also, sometimes ps is a few seconds out of date, an eternity in process time. I see some briefly defunct processes coming from some hp utility, so grepping the ppid always shows something defunct, which can be confusing if you don't notice the changing pid.
As Joel said.
A parent process receives a signal when one of its child processes terminates. When the parent process does not exist, the signal cannot be processed.
The kernel then keeps the basic process identifier struct of the child in memory (not very large) - after unloading the actual child process from the kernel.
The child process no longer exists. Except for the tiny process identifier struct in the process list table of the kernel.
Thus the name zombie process. Process is dead (no longer loaded). Nor can it be killed. The identifier in the process listing can only be cleared with a kernel reboot afaik.
Why exactly the Unix kernel behaves this way, I cannot recall... but there are some or another technical explanation for it.