The Undead Process
A Zombie process is a process that has finished executing (called exit()) but whose parent has not yet called wait() to collect its exit status. It sits in the process table as a ghost — consuming almost no resources (no RAM, no CPU, no open files), but occupying one slot in the process table.
You can spot zombies in ps output by the Z in the STAT column, with the process name shown suffixed as <defunct>.
Why zombies accumulate: In a well-written program, zombies exist for microseconds — the parent calls wait() almost immediately. Zombies pile up when a parent process is buggy: it forks children to handle work but never calls wait() to reap them. Over time, the process table fills with defunct entries.
Why you can't kill -9 a zombie: The process is already dead. SIGKILL is a request for the kernel to terminate a process — but there's nothing left to terminate. The zombie's entry persists only because the kernel is waiting for the parent to read the exit code.
The fix: You cannot remove a zombie directly. You must either:
1. Fix the parent to call wait() properly (the right solution).
2. Kill the parent process — the kernel will then re-parent the zombie to PID 1 (init/systemd), which automatically calls wait() and cleans it up.
A handful of zombies is harmless. Thousands of zombies can exhaust the process table (which has a finite size, typically 32,768 entries on Linux), preventing any new processes from being created — including the kill command you'd use to fix the problem.