[UNIX] zombie process Processing

What is a zombie process?
A zombie process means that its parent process has exited (the parent process has not waited (wait/waitpid is called) it), and after the dead process has no process to accept, it becomes a zombie process, that is, the (zombie) process.
How is a zombie process?
When a process calls the exit command to end its own life, it is not actually destroyed, but it leaves a data structure called Zombie (the system calls exit, it is used to exit a process, but it is only limited to converting a normal process into a zombie process and cannot completely destroy it ).
In the status of a Linux Process, a zombie process is a very special one. It has abandoned almost all the memory space, no executable code, and cannot be scheduled, only one location is retained in the process list, and information such as the exit status of the process is recorded for collection by other processes. In addition, zombie processes no longer occupy any memory space. It needs its parent process to collect the corpse for it.
If the parent process does not have the SIGCHLD signal processing function that calls wait or waitpid () and waits for the child process to end, and does not explicitly ignore the signal, it will remain zombie, if the parent process ends at this time, the init process will automatically take over the child process and collect the corpse for it. It can still be cleared.

However, if the parent process is a loop and does not end, the child process will remain zombie, which is why many zombie processes sometimes exist in the system. The process number that the system can use is limited. If a large number of zombie processes are generated, the system cannot generate new processes because there is no available process number.

Zombie process avoidance

1. The parent process waits for the child process to end through functions such as wait and waitpid, which causes the parent process to stop.
2. If the parent process is very busy, you can use the signal function to install handler for SIGCHLD, because after the child process ends, the parent process will receive this signal and can call wait recycle in handler.
3. If the parent process does not care when the child process ends, you can use SIGCHLD (SIG_IGN) to notify the kernel that you are not interested in the end of the Child process. After the child process ends, the kernel recycles and does not send signals to the parent process.

4. There are some other skills: fork two times. The parent process fork is a sub-process, and then continues to work. The sub-process fork is a sub-process and then exits, so the sun process is taken over by init, after the sun process ends, init will recycle it. However, the sub-process must be recycled by itself.

Why do sub-processes enter the botnet status after the process ends?

Because the parent process may need to obtain information such as the exit status of the child process.
Is the botnet status necessary for every sub-process?
Any sub-process (except init) does not disappear immediately after exit (), but leaves a data structure called Zombie (which occupies a little memory resources, that is, there is a record in the Process Table), waiting for processing by the parent process. This is the stage that every sub-process will go through at the end. If the parent process does not have time to process the child process after exit (), run the ps command to check that the child process is in the "Z" status ".
If the parent process can be processed in a timely manner, you may not be able to see the zombie state of the child process using the ps command, but this does not mean that the child process does not pass through the zombie state.
If the parent process exits before the child process ends, the child process will be taken over by init. Init processes child processes in zombie state as the parent process.
How to view botnets
In linux, the ps command shows that a process marked as Z is a zombie process.
Ps-ef | grep defunc can identify zombie processes.
You can use the-l option of ps to obtain more detailed process information. F (Flag): The sum of a series of numbers, indicating the current state of the process. The meanings of these numbers are:
00: If it is displayed separately, the process has been terminated.
01: A process is a part of the core process and resident in the main memory of the system. Such as sched, vhand, and bdflush.
02: Parent is tracing process.
04: Tracing parent's signal has stopped the process; the parent is waiting (ptrace (s )).
10: A process enters sleep state when its priority is lower than or equal to 25, and cannot be awakened by a signal, for example, waiting for an inode to be created
20: The process is loaded into the primary memory (primary memory)
40: The process is locked in the primary memory and cannot be replaced before the transaction is completed.
S (state of the process)
O: the process is running as a processor.
S: sleeping)
R: runable)
I: idle)
Z: zombie)
T: trace status (Traced)
B: The process is waiting for more memory pages.
C: Estimated cpu usage (cpu usage)
How to clear zombie Processes
1. Rewrite the parent process and send it to the dead after the child process dies. The specific method is to take over the SIGCHLD signal. After a child process dies, it sends a SIGCHLD signal to the parent process. After receiving the signal, the parent process executes the waitpid () function to collect the child process. This is based on the principle that even if the parent process does not call wait, the kernel will send SIGCHLD messages to it, even though the default processing is ignored. If you want to respond to this message, you can set a processing function.
SIGCHLD signal: when the child process ends, the parent process receives this signal. If the parent process does not process this signal and does not wait for the child process (wait), although the child process terminates, it still occupies a table item in the kernel table, at this time, sub-processes are called Zombie processes. In this case, we should avoid (parent process, ignore the SIGCHILD signal, or capture it, or wait, its derived child process, or the parent process is terminated first, at this time, the termination of the sub-process is automatically taken over by the init process ).
2. kill-18 PPID (PPID is its parent process)
This signal tells the parent process that the child process has died. Please reclaim the resources allocated to it.
SIGCONT is also an interesting signal. As mentioned above, when a process stops, this signal is used to tell the process to resume running. The interesting thing about this signal is that it cannot be ignored or blocked, but can be captured. The default action is to discard the signal.
3. Terminate the parent process
If method 2 cannot be terminated, You can terminate the parent process (if the parent process does not need it). After the death of the parent process, the zombie process becomes an "orphan process" and passes the process init to process 1, init is always responsible for cleaning up zombie processes. all the zombie processes it generates also disappear.
First, check that the parent process has no other sub-processes. If yes, you may need to kill other sub-processes, that is, brother processes. The method is:
Kill-15 PID1 PID2 (PID1, PID2 is another sub-process of the parent process of the zombie process ).
Then kill the parent process: kill-15 PPID
In this way, the zombie process may be completely killed.

Source: