0
admin@dummy$ ps -l
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
0 S  1000 22156 22155  0  80   0 -  1545 wait   pts/0    00:00:00 bash
0 S  1000 22997     1  0  80   0 -  4743 poll_s pts/0    00:00:15 python
1 S  1000 23000 22997  0  80   0 - 11514 poll_s pts/0    00:00:01 python
0 R  1000 30567 22156  0  80   0 -   625 -      pts/0    00:00:00 ps

admin@dummy$ ps -el | grep 'Z'
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
0 Z  1000 21187  1130  0  80   0 -     0 exit   ?        00:00:00 sh <defunct>

Hmmm I am new to dealing with zombie. But am I not supposed to look up the PPID against the PPID displayed in ps -l ??

Which one is the zombie's parent? Is it bash that's the zombie parent? Thanks.


Update

dummy:~$ pstree --
init─┬─apache2───5*[apache2]
     ├─atd
     ├─condor_master─┬─condor_collecto
     │               ├─condor_negotiat
     │               └─condor_schedd───condor_procd
     ├─console-kit-dae───63*[{console-kit-da}]
     ├─cron
     ├─daemon───java───22*[{java}]
     ├─dbus-daemon
     ├─dhclient3
     ├─6*[getty]
     ├─java───20*[{java}]
     ├─mysqld───11*[{mysqld}]
     ├─nginx───4*[nginx]
     ├─portmap
     ├─postgres───4*[postgres]
     ├─python
     ├─2*[python───python]
     ├─rpc.statd
     ├─rsyslogd───3*[{rsyslogd}]
     ├─sh───mongod───6*[{mongod}]
     ├─slapd───5*[{slapd}]
     ├─sshd─┬─sshd───sshd───bash───vim
     │      ├─sshd───sshd───bash───python
     │      ├─sshd───sshd───bash
     │      └─sshd───sshd───bash───pstree
     ├─udevd───2*[udevd]
     └─upstart-udev-br

So it seems like it's mogod that's the parent. Am I correct?

1
  • Use the "pstree -p" instead of "pstree --".
    – Chakri
    May 3, 2012 at 21:38

3 Answers 3

2

The best tool to figure the relation between processes is pstree - display a tree of processes

Eg: - sample pstree output

    ├─mysqld_safe(2040)───mysqld(2129)─┬─{mysqld}(2131)
    │                                  ├─{mysqld}(2132)
    │                                  ├─{mysqld}(2133)
    │                                  ├─{mysqld}(2134)
    │                                  ├─{mysqld}(2136)
    │                                  ├─{mysqld}(2137)
    │                                  ├─{mysqld}(2138)
    │                                  ├─{mysqld}(2139)
    │                                  └─{mysqld}(2140)
    ├─named(21549)─┬─{named}(21550)
    │              ├─{named}(21551)
    │              ├─{named}(21552)
    │              ├─{named}(21553)
    │              ├─{named}(21554)
    │              └─{named}(21555)
2
  • Thanks. I don't see the process id though. But it seems like it's mongd that's the parent, am I correct? Thanks!
    – CppLearner
    May 3, 2012 at 21:23
  • Use the "pstree -p" instead of "pstree --" .
    – Chakri
    May 3, 2012 at 21:33
0

Match the parent ID (PPID) with the PID

0

The process ID of your zombie process is 1130, which doesnt appear in the output that youve printed.

PID = Process ID 
PPID = Parent Process ID
2
  • You mean the parent is supposed to be 1130, right?
    – CppLearner
    May 3, 2012 at 21:22
  • Yes, PPID is the process ID of the parent. The PID of the zombie is 21187, now find the process with PID 1130.
    – Sirch
    May 3, 2012 at 22:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .