What is a process, and why doesn't it get killed?

Question

The chrome browser was not responsive and I tried to kill it, but instead of disappearing the process had <defunct> at its right, and didn't get killed:

What is <defunct> for a process and why it doesn't it get killed?

Answer 1

From your output we see a <defunct>, which means the process has either completed its task or has been corrupted or killed, but still has child processes running or its parent process is not monitoring it properly (i.e. it does not run the code to clean it up). To kill this kind of process, kill -9 PID doesn't work. You can try to kill them with that command, but it will remain in the list of processes.

To fix the issue, determine the parent process of the defunct process and kill it. To know the PID of the parent, run the command:

$ ps -ef | grep defunct
    UID    PID   PPID  C   STIME   TTY  TIME      CMD
   1000    637  27872  0   Oct12   ?    00:00:04  [chrome] <defunct>
   1000   1808   1777  0   Oct04   ?    00:00:00  [zeitgeist-datah] <defunct>

Then kill -9 637 27872 (i.e kill of the PID and PPID), then verify that the defunct process is now gone running the ps -ef | grep defunct again.

---

WARNING (added by Alexis Wilke, not the author): Since I looked into this and this is marked as the accepted answer, I think it's worth having a warning:

• Before killing the parent, you may want to check what process this is:

   $ ps -ef | grep 27872
   alexis  4927  4360  4 Apr19 ?  13:19:17/usr/bin/gnome-shell
  

  Yep. In my case, the parent is gnome-shell. I probably do not want to kill that one. In this case, I'll have to reboot.

Answer 2

Manual page ps(1) says:

Processes marked <defunct> are dead processes (so-called "zombies") that remain because their parent has not destroyed them properly. These processes will be destroyed by init(8) if the parent process exits.

You can't kill it because it is already dead. The only thing left is an entry in the process table:

On Unix and Unix-like computer operating systems, a zombie process or defunct process is a process that has completed execution but still has an entry in the process table. This entry is still needed to allow the parent process to read its child's exit status.

There is no harm in letting such processes be unless there are many of them. Zombie is eventually reaped by its parent (by calling wait(2)). If original parent hasn't reaped it before its own exit then init process (pid == 1) does it at some later time. Zombie Process is just:

A process that has terminated and that is deleted when its exit status has been reported to another process which is waiting for that process to terminate.

Answer 3

I accidently create <defunct> processes by

• starting them from the terminal and
• then putting them into the background by accident (Ctrl+Z) and
• somehow terminating the programm.

Solution is to try the command fg in every open terminal window. Then the defunct processes disappear.

Answer 4

Adding to @Paddington's answer, I added this function to my bashrc for quick checking:

defunct(){
    echo "Children:"
    ps -ef | head -n1
    ps -ef | grep defunct
    echo "------------------------------"
    echo "Parents:"
    ppids="$(ps -ef | grep defunct | awk '{ print $3 }')"
    echo "$ppids" | while read ppid; do
        ps -A | grep "$ppid"
    done
}

It outputs something like:

Children:
UID        PID  PPID  C STIME TTY          TIME CMD
user     25707 25697  0 Feb26 pts/0    00:00:00 [sh] 
user     30381 29915  0 11:46 pts/7    00:00:00 grep defunct
------------------------------
Parents:
25697 pts/0    00:00:00 npm

Answer 5

I made a script in python to automatically find and kill all defunct processes, here it is in case it is useful for someone:

import os
import re
Find defunct processes and save them to temporary file
os.system("ps -ef | grep defunct > zombies.txt")
pids = []
Load data from defunct processes file and remove the file
zombies = open("zombies.txt", "r").read()
os.system("rm zombies.txt")
print(zombies)
For each zombie process, find the integers correspoding to the PID and PPID
for z in zombies.split(" "):
    ints = re.findall(r'^[-+]?([1-9]\d*|0)$',z)
    if len(ints)==1:
        pids.append(ints[0])
There should be 3 integers per process
assert len(pids)%3==0
Kill process by PID and PPID
for i in range(len(pids)//3):
os.system("kill -9 "+pids[3*i]+" "+pids[3*i+1])

Answer 6

Thank you Mike S. We took your line and wrote a script that will kill defunct processes whose parent is in.telnetd. We didn't want it to kill any parent process, just telnetd that we know is causing a problem and we'll run it multiple times to kill multiple ones if needed.

# egrep -v '^1$ = Make sure the process is not the init process.
# awk '{print $3}' = Print the parent process.

first_parent_of_first_dead_kid=$(ps -ef | grep [d]efunct | awk '{print $3}' | head -n1 | egrep -v '^1$')
echo "$first_parent_of_first_dead_kid"

# If the first parent of the first dead kid is in.telnetd, then kill it.
if ps -ef | grep $first_parent_of_first_dead_kid | grep in.telnetd;then
        echo "We have a defunct process whose parent process is in.telnetd" | logger -t KILL-DEFUNCT-TELNET
        echo "killing $first_parent_of_first_dead_kid" | logger -t KILL-DEFUNCT-TELNET
        kill $first_parent_of_first_dead_kid 2>&1 | logger -t KILL-DEFUNCT-TELNET
fi

Answer 7

I had a libreoffice application zombie hanging with and 'Z'. and its PPID was 1 (because I had killed the calling application oosplash after LibreOffice wasn't responding anymore). However, no files were in use by the zombie. Still, the office icons were still on my desktop/taskbar.

I have managed to get the application (or process ID) cleaned up and being able to start libreoffice again without the need for a reboot:

First, I removed the .lock file in the ~/.config/libreoffice/ directory. (don't know if it is relevant, but just for completeness of what I did). Next I started libreoffice on another host (so under same login). Office started normally on this new host. At the same time: all the 'hanging' libreoffice icons were gone. Once 'Document recovery' was complete, I had closed all open documents and exited libreoffice on this new host. (Please note that the document files are on a fileserver that is accessible to both hosts.)

I restarted libreoffice on the original host and that went without problems and no need to reboot.

Maybe the recipe doesn't work all the time, maybe a coincidence with my host cleaning up the orphan process at precisely the same time, but I was lucky to avoid the reboot. Maybe it helps others as well. just give it a try.

Good luck!