What is a <defunct> process, and why doesn't it get killed?
Solution 1
From your output we see a "defunct", which means the process has either completed its task or has been corrupted or killed, but its child processes are still running or these parent process is monitoring its child process. To kill this kind of process, kill -9 PID doesn't work. You can try to kill them with this command but it will show this again and again.
Determine which is the parent process of this defunct process and kill it. To know this run the command:
$ ps -ef | grep defunct
UID PID PPID C STIME TTY TIME CMD
1000 637 27872 0 Oct12 ? 00:00:04 [chrome] <defunct>
1000 1808 1777 0 Oct04 ? 00:00:00 [zeitgeist-datah] <defunct>
Then kill -9 637 27872
, then verify the defunct process is gone by ps -ef | grep defunct
.
Solution 2
Processes marked
<defunct>
are dead processes (so-called "zombies") that remain because their parent has not destroyed them properly. These processes will be destroyed byinit(8)
if the parent process exits.
You can't kill it because it is already dead. The only thing left is an entry in the process table:
On Unix and Unix-like computer operating systems, a zombie process or defunct process is a process that has completed execution but still has an entry in the process table. This entry is still needed to allow the parent process to read its child's exit status.
There is no harm in letting such processes be unless there are many of them. Zombie is eventually reaped by its parent (by calling wait(2)
). If original parent hasn't reaped it before its own exit then init
process (pid == 1
) does it at some later time. Zombie Process is just:
A process that has terminated and that is deleted when its exit status has been reported to another process which is waiting for that process to terminate.
Solution 3
expanding on Paddington's answer..
From your output we see a defunct, which means this child process has either completed its task or has been corrupted or killed. Its parent process is still running and has not noticed its dead child.
kill -9 PID
won't work (already dead).
To determine the parent of this child process, run this command:
ps -ef | grep defunct
UID PID **PPID** C STIME TTY TIME CMD
1000 637 27872 0 Oct12 ? 00:00:04 [chrome] <defunct>
See who the parent is: ps ax | grep 27872
If you want you can kill the parent, and the defunct will go away.
kill -9 27872
see Jfs answer for a more technical reasoning.
Solution 4
I accidently create <defunct>
processes by
- starting them from the terminal and
- then putting them into the background by accident (Ctrl+Z) and
- somehow terminating the programm.
Solution is to try the command fg
in every open terminal window.
Then the defunct processes disappear.
Solution 5
Adding to @Paddington's answer, I added this function to my bashrc for quick checking:
defunct(){
echo "Children:"
ps -ef | head -n1
ps -ef | grep defunct
echo "------------------------------"
echo "Parents:"
ppids="$(ps -ef | grep defunct | awk '{ print $3 }')"
echo "$ppids" | while read ppid; do
ps -A | grep "$ppid"
done
}
It outputs something like:
Children: UID PID PPID C STIME TTY TIME CMD user 25707 25697 0 Feb26 pts/0 00:00:00 [sh] user 30381 29915 0 11:46 pts/7 00:00:00 grep defunct ------------------------------ Parents: 25697 pts/0 00:00:00 npm
Related videos on Youtube
Eduard Florinescu
Coding my way out of boredom. “If the fool would persist in his folly he would become wise.” (William Blake)
Updated on September 18, 2022Comments
-
Eduard Florinescu over 1 year
The chrome browser was not responsive and I tried to kill it, but instead of disappearing the process had
<defunct>
at its right, and didn't get killed:What is
<defunct>
for a process and why it doesn't it get killed?-
Admin over 7 yearsThe accepted answer mentions that "
kill -9 PID
don't work". It's partially true: in reality, NO kill will work. Besides, -9 should be used as a last resort. 99% of the time a default kill of the parent process will kill it AND reap all the children. A "default kill" is a SIGTERM (-15). I encourage fans of the -9 (SIGKILL) to read stackoverflow.com/questions/690415/… -
Admin about 6 years
-
Admin about 3 yearsnames matter a lot, presenting
<zombie>
instead of<defunct>
would explain itself why kill is not an option. You cannot kill a zombie.
-
-
jfs about 10 yearsyou can't kill "defunct" process. You only can speed up the deletion of its entry in a process table by killing its parent.
-
Luc about 10 yearsWhat if the ppid is
1
(init
)? Suppose I'll just have to wait? -
azv over 9 yearsto automate the kill, you can do this, too (might need to change which bytes you're cutting from the output):
ps -ef | grep defunct | grep -v grep | cut -b8-20 | xargs kill -9
-
user3590305 almost 8 years@warren Thanks. You can also make that slightly shorter and (imo) simpler by not doing a second grep. Just change the first grep to
grep [d]efunct
or similar and it won't match itself. -
Mike S over 7 years@warren you can't kill a defunct process- even with a SIGKILL. Furthermore, you're using kill -9 pretty indiscriminately. See stackoverflow.com/questions/690415/… . If you want to kill defunct children, you might try:
parents_of_dead_kids=$(ps -ef | grep [d]efunct | awk '{print $3}' | sort | uniq | egrep -v '^1$'); echo "$parents_of_dead_kids" | xargs kill
. Rerun the script after 30 seconds or so, with thekill -9
if you desire. (Note that I specifically disallow killing ofInit
) -
azv over 7 years@MikeS I didn't say it was the best option. I said it would speed-up what JFSebastian said. As with any code on the intarwebs, I would expect you to try it before you just deploy it in cron, for example (and gave a disclaimer on which bytes are being
cut
) -
azv over 7 years@Thor84no the
| grep -v grep
addition has become habit because it's easier to think about 🙂. There are ways of not needing to use it, however - and that is a good suggestion. -
xeruf almost 6 yearswhat if this did not work for me?
-
John Strood almost 6 years@Xerus Then restart the system. That'll kill all processes.
-
aroth over 5 yearsWhat @Luc said. Exactly what Luc said.
-
Gopal Venu over 5 yearsWhy
-9
is necessary for parent? -
Philippe Paré about 5 yearsIf ppid is 1 see unix.stackexchange.com/questions/5642/…
-
Andyc almost 5 yearsAnd what if the parent process is uninterruptible? Is there really nothing to do other than restarting the computer?
-
Scott over 4 years"There is no harm in letting such processes be unless there are many of them". This isn't true. These defunct processes can still keep file handles open (lock files for instance), and ports open. Sometimes there is no saving these processes without a system reboot, as far as I can tell.
-
jfs over 4 years@Scott: why do you think a dead process keeps file handles open? Do you have a link to docs, a script that would demonstrate such behavior?
-
Scott over 4 yearsUnfortunately I don't have any evidence beyond the fact that I've seen it happen, and I don't know the next time one of the processes will get stuck again to repro. Most recently I verified using "lsof" on a file that it was being held open by the same pid as my defunct process. Previously I've (using netstat/lsof) seen that my defunct process still held the port it was listening on open. This has been enough of a problem that I've built defense in my init.d scripts to wait for the defunct process to clear when doing restarts so the new process can bind the port. Will screenshot if I repro
-
jfs over 4 years@Scott: It doesn't look like the issues you've mentioned are related to the process being a zombie as in I would be surprised that a dead process may keep file handles open. Let's avoid unsubstantiated misleading claims
-
Scott over 4 yearsIf you don't accept that I've seen defunct processes hold ports and files open, that's fine, but my reasoning is neither unsubstantiated nor misleading. It's substantiated by empirical evidence and the whole reason I said it the first place was to ensure that readers of the answer do not get mislead. Doing some more research, it seems that at least for ports, sockets can stay open, even if the process is technically dead. So the end result for the user is the same, the port is held open. superuser.com/questions/1196736/…
-
jfs over 4 years@Scott: is there really a connection between a process being zombie (not just dead) and "port is held open"? (the fact that network resources may outlive a single process is not under question idea.popcount.org/2019-09-20-when-tcp-sockets-refuse-to-die )
-
JoeManiaci over 3 yearsI have dozens of defunct processes I can't kill, the shutdown command won't work, and even through the GUI, the shutdown menu won't come up
-
Ajay A almost 3 yearsHow do I differentiate between a process that is completed & a process that is killed or corrupted??
-
Kevin almost 3 years@AjayA why do you want to distinguish between them? A process that exited either success (exit 0) or fail (non zero exit code). in either case, the parent is too busy to pay attention to the child process that is not running.
-
Ajay A almost 3 yearsI have use case, where I want kill the child & parent process, if the child process is killed or corrupted & do not want do this in process complete case
-
Kevin almost 3 years@AjayA I would poke around in Proc, cat /proc/pid/status, or other entries in /proc/pid/xxx
-
Rick Moritz over 2 years
bg
works just as well - anything that unfreezes the process from the shell which still holds the handle to it.