What is a zombie process and an orphan process in Linux?
Understand zombie and orphan processes in Linux: how each forms, why zombies linger in the process table, and how init/systemd reaps orphans — with examples.
Expected Interview Answer
A zombie process is a finished child process whose exit status has not yet been read by its parent, so it lingers in the process table as a dead entry. An orphan process is a still-running child whose parent has exited, leaving it to be adopted by init/systemd (PID 1).
When a process exits, the kernel keeps a small entry so the parent can retrieve its exit code with wait(); until the parent calls wait(), that entry is a zombie (state Z, shown as <defunct>). It holds no memory or CPU, only a slot in the process table. An orphan is different: its parent died first, so PID 1 becomes its new parent and will reap it when it eventually finishes, preventing it from ever becoming a permanent zombie.
- Understanding zombies helps diagnose process-table exhaustion
- Explains why proper wait()/reaping matters in daemons
- Clarifies the reaping role of init/systemd (PID 1)
- Guides handling of SIGCHLD in long-running parents
- Distinguishes harmless orphans from problematic zombie buildup
AI Mentor Explanation
A zombie process is like a dismissed batter whose scorecard entry is written but the scorer hasn't yet recorded the runs and mode of dismissal — the player is out and off the field, yet an unfinished line sits in the book until the scorer files it. An orphan is like a junior player whose coach has left the ground mid-match, so the team captain takes charge of him until stumps.
Step-by-Step Explanation
Step 1
A child process exits
The child finishes and the kernel keeps a small process-table entry holding its exit status.
Step 2
Parent must reap it
The parent is expected to call wait() or waitpid() to read that status and release the entry.
Step 3
Zombie forms if unreaped
Until the parent reaps it, the entry sits in state Z (<defunct>), consuming a PID slot but no memory or CPU.
Step 4
Orphan when parent dies first
If a parent exits while its child still runs, the child becomes an orphan and is re-parented to init/systemd (PID 1).
Step 5
PID 1 reaps orphans
init/systemd calls wait() on its adopted children when they finish, so orphans never linger as permanent zombies.
What Interviewer Expects
- Clear definition of zombie vs orphan
- Role of wait()/waitpid() in reaping children
- That zombies occupy a process-table slot, not memory or CPU
- That orphans are adopted by PID 1 (init/systemd)
- How SIGCHLD relates to reaping in long-lived parents
Common Mistakes
- Claiming zombies consume CPU or large amounts of memory
- Confusing zombie and orphan definitions
- Thinking you can kill a zombie with kill -9 (you reap the parent)
- Believing orphans become permanent zombies
- Ignoring SIGCHLD handling in daemons that fork children
Best Answer (HR Friendly)
“A zombie process is a finished program that hasn't been fully cleaned up because its parent hasn't collected its exit result, so a leftover entry stays in the system. An orphan is a still-running program whose parent has already quit, so the system's main process adopts it and cleans it up when it finishes.”
Code Example
# List processes and look for the Z (zombie) state
ps aux | grep 'Z'
# STAT column showing Z, command shown as <defunct>
# Show parent PID to find who should reap the zombie
ps -o pid,ppid,stat,cmd -e | grep defunct
# You cannot kill a zombie directly; nudge its parent to reap it
kill -SIGCHLD <parent_pid>
# If the parent won't reap, terminating the parent re-parents
# the entry and lets init/systemd (PID 1) clean up the zombie.Follow-up Questions
- How do you get rid of a zombie process on a running system?
- What system call does a parent use to reap a child?
- Why can't kill -9 remove a zombie process?
- What happens to a child process when its parent dies?
- How does SIGCHLD help a parent avoid creating zombies?
MCQ Practice
1. What resource does a zombie process primarily hold onto?
A zombie holds only a process-table entry storing its exit status; it uses no CPU or meaningful memory until the parent reaps it.
2. Which process adopts an orphan in Linux?
When a parent exits before its child, the child is re-parented to init/systemd (PID 1), which reaps it when it finishes.
3. How is a zombie normally cleared?
The parent must call wait()/waitpid() to reap the child; if it never does, terminating the parent lets PID 1 clean it up.
Flash Cards
What is a zombie process? — A terminated child whose exit status hasn't been reaped by its parent; it stays in state Z (<defunct>) holding only a PID slot.
What is an orphan process? — A still-running child whose parent has exited; it is re-parented to init/systemd (PID 1).
How is a zombie reaped? — The parent calls wait()/waitpid() to read the exit status; if it won't, killing the parent lets PID 1 reap it.
Do zombies use CPU or memory? — No — they consume only a process-table entry, not CPU or meaningful memory.