Dawn of the Linux dead

David M Williams
Monday, 25 February 2008 14:12

Opinion and Analysis

In actual fact, every running Linux process could theoretically end up as a zombie process. The reason is that Linux deliberately keeps a ghost of a completed process hanging around so its exit status can be interrogated.

Let’s back up a bit. By design, Linux lets every program return a numeric value when it exits. This may not be exploited by the programmer, but is most commonly used to report back the success or otherwise of the program.

Apps can launch other apps via system calls, or they can fork off child processes allowing multiple threads of activities to be happening at once. This is commonly used in programs that service TCP/IP requests. For example, a process receives an incoming connection on a certain port. It then forks off a child process to deal with the connection while the main body of the app loops and waits again for another connection.

When a child process – or indeed any process – completes it becomes a zombie process until the app which called it runs a system call named wait. The wait call notifies that the process has finished and delivers the return value that the process exited with. Extending the zombie analogy this is known as reaping because it harvests all the zombie children.

A well-written program will use wait to clean up after itself. Not all apps are well-written; in this case the zombies hang around until the parent process itself finally exits. If the parent never takes a long time before it finishes, or if it never completes, the zombies will stay around. If the parent does finish, however, its zombie children are adopted by Linux process #1, init, and are then finally reaped.

So that’s zombies in Linux! Beginning Linux programmers may not be aware that this happens, or may not really care to know the exit status of a process they have forked. However, the thing is the kernel does not know this; it assumes the parent process is interested in the return code so it sends a signal (SIGCHILD) to the parent and keeps the process hanging about as a zombie with its final exit code. Until the parent invokes wait to collect the exit code the process remains in its zombie state.

I hope you’ve enjoyed this three part technical series on the inner workings of Linux. Please let me know if you’d like to see more items like this. Until then, now you know a major way to tweak Linux’ responsiveness, you know how to benchmark where an app is spending all its time, you know what it means to do something in a jiffy and you know just what Linux has in common with Dawn of the Dead!