How to Find the List of Daemon Processes and Zombie Processes in Linux

This article will guide you to understand zombie processes and daemon processes, and help you identify processes running in the background on Linux systems.

What is a Zombie Process?

When a process completes execution, it must report its exit status to its parent process. During this brief period, the process remains in the OS process table as a zombie process. The zombie indicates that the process will not be scheduled for future execution, but it cannot be completely removed until the parent process reads its exit status.

When a child process completes, the parent process receives a SIGCHLD signal indicating that one of its children has finished executing. The parent typically calls the wait() system call to retrieve the child's exit status, which causes the zombie process to be reaped (removed from the process table).

What are Daemon Processes?

Linux is a multi-tasking operating system where each running program is called a process. Every process has a unique Process ID (PID) and runs under specific owner and group permissions.

Daemon processes are programs designed to run continuously in the background without user interaction or terminal attachment. Examples include web servers responding to HTTP requests and mail servers handling email delivery. These processes typically start at boot time and run until the system shuts down.

Finding Zombie Processes

To identify zombie processes, use the ps command and look for processes with status Z in the STAT column:

ps aux

USER    PID  %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root   1234  0.0  0.0      0     0 ?        Z    Mar18   0:20 [process_name] <defunct>
root   5678  0.0  0.1 549100  7348 ?        S    Mar18   0:13 /usr/bin/daemon_process

In this example, process 1234 has status Z, indicating it's a zombie process marked as <defunct>.

Finding Daemon Processes

Daemon processes can be identified by several characteristics:

Method 1: Using ps with Filtering

ps -ef | grep -v "pts/"

This shows processes not attached to terminal sessions (typical of daemons).

Method 2: Check Process Status

ps aux | grep -E "(D|S|I)"

Look for processes with STAT values:

• D − Uninterruptible sleep (usually I/O)

• S − Interruptible sleep (waiting for events)

• I − Idle kernel threads

Method 3: Using systemctl (SystemD Systems)

systemctl list-units --type=service --state=running

UNIT                     LOAD   ACTIVE SUB     DESCRIPTION
httpd.service           loaded active running The Apache HTTP Server
sshd.service            loaded active running OpenSSH server daemon
mysqld.service          loaded active running MySQL Community Server

Common Process Management Commands

Handling Zombie Processes

To remove a zombie process, you typically need to:

1. Identify the zombie process PID using ps aux | grep Z

2. Find its parent process using ps -f --pid PID

3. Kill the parent process or restart it to clean up zombies

# Find zombie processes
ps aux | grep " Z "

# Kill zombie by killing parent (if safe)
kill -TERM parent_pid

Note: You cannot directly kill a zombie process. The parent must read the child's exit status to remove it from the process table.

Conclusion

Understanding zombie and daemon processes is essential for Linux system administration. Zombies are temporary states that should be cleaned up by parent processes, while daemons are long-running background services. Use ps, systemctl, and process status flags to identify and manage these different process types effectively.