Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
admin@dummy$ ps -l
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
0 S  1000 22156 22155  0  80   0 -  1545 wait   pts/0    00:00:00 bash
0 S  1000 22997     1  0  80   0 -  4743 poll_s pts/0    00:00:15 python
1 S  1000 23000 22997  0  80   0 - 11514 poll_s pts/0    00:00:01 python
0 R  1000 30567 22156  0  80   0 -   625 -      pts/0    00:00:00 ps

admin@dummy$ ps -el | grep 'Z'
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
0 Z  1000 21187  1130  0  80   0 -     0 exit   ?        00:00:00 sh <defunct>

Hmmm I am new to dealing with zombie. But am I not supposed to look up the PPID against the PPID displayed in ps -l ??

Which one is the zombie's parent? Is it bash that's the zombie parent? Thanks.


Update

dummy:~$ pstree --
init─┬─apache2───5*[apache2]
     ├─atd
     ├─condor_master─┬─condor_collecto
     │               ├─condor_negotiat
     │               └─condor_schedd───condor_procd
     ├─console-kit-dae───63*[{console-kit-da}]
     ├─cron
     ├─daemon───java───22*[{java}]
     ├─dbus-daemon
     ├─dhclient3
     ├─6*[getty]
     ├─java───20*[{java}]
     ├─mysqld───11*[{mysqld}]
     ├─nginx───4*[nginx]
     ├─portmap
     ├─postgres───4*[postgres]
     ├─python
     ├─2*[python───python]
     ├─rpc.statd
     ├─rsyslogd───3*[{rsyslogd}]
     ├─sh───mongod───6*[{mongod}]
     ├─slapd───5*[{slapd}]
     ├─sshd─┬─sshd───sshd───bash───vim
     │      ├─sshd───sshd───bash───python
     │      ├─sshd───sshd───bash
     │      └─sshd───sshd───bash───pstree
     ├─udevd───2*[udevd]
     └─upstart-udev-br

So it seems like it's mogod that's the parent. Am I correct?

share|improve this question
    
Use the "pstree -p" instead of "pstree --". –  Chakri May 3 '12 at 21:38
add comment

3 Answers 3

up vote 2 down vote accepted

The best tool to figure the relation between processes is pstree - display a tree of processes

Eg: - sample pstree output

    ├─mysqld_safe(2040)───mysqld(2129)─┬─{mysqld}(2131)
    │                                  ├─{mysqld}(2132)
    │                                  ├─{mysqld}(2133)
    │                                  ├─{mysqld}(2134)
    │                                  ├─{mysqld}(2136)
    │                                  ├─{mysqld}(2137)
    │                                  ├─{mysqld}(2138)
    │                                  ├─{mysqld}(2139)
    │                                  └─{mysqld}(2140)
    ├─named(21549)─┬─{named}(21550)
    │              ├─{named}(21551)
    │              ├─{named}(21552)
    │              ├─{named}(21553)
    │              ├─{named}(21554)
    │              └─{named}(21555)
share|improve this answer
    
Thanks. I don't see the process id though. But it seems like it's mongd that's the parent, am I correct? Thanks! –  CppLearner May 3 '12 at 21:23
    
Use the "pstree -p" instead of "pstree --" . –  Chakri May 3 '12 at 21:33
add comment

Match the parent ID (PPID) with the PID

share|improve this answer
add comment

The process ID of your zombie process is 1130, which doesnt appear in the output that youve printed.

PID = Process ID 
PPID = Parent Process ID
share|improve this answer
    
You mean the parent is supposed to be 1130, right? –  CppLearner May 3 '12 at 21:22
    
Yes, PPID is the process ID of the parent. The PID of the zombie is 21187, now find the process with PID 1130. –  Sirch May 3 '12 at 22:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.