Zombie process after reboot

[Carlos Munoz Lopez]

Hi guys. I've been having a problem with a process. The system keeps displaying a zombie process just after I reboot the server. I tried to kill the process but it doesn't work, I rebooted the system so it can be removed, but still doesn't work. I don't know why this process keeps showing up:

root 29937 2600 0 16:02:43 ? 0:00

Is this normal? Is it because the OS needs a patch to correct this? These are the set of patches installed on the server (HP-UX 11i, server rp7470)

BUNDLE11i B.11.11.0306.1 Required Patch Bundle for HP-UX 11i, June 2003
GOLDAPPS11i B.11.11.0412.5 Gold Applications Patches for HP-UX 11i v1, December 2004
GOLDBASE11i B.11.11.0412.5 Gold Base Patches for HP-UX 11i v1, December 2004
HWEnable11i B.11.11.0412.5 Hardware Enablement Patches for HP-UX 11i v1, December 2004

Any suggestion on how I could solve this problem. I would like some help on this. Thanks.

[Mel Burslan · Accepted solution]

Zombie processes sometimes happen, despite how much we hate to see them. Not all zombies are resource eaters and without somebody analyzing your system by logging in to it, it is very hard to determine what is causing the zombie.

If you do not have a performance problem or any other ill effect, I would not worry about this one process. But if there is an implication, adversity of any sort, my suggestion would be to reboot the system to a fresh start and immediately after reboot, go to the console, and hit ctrl-b and drop to gsp prompt. Execute a TC command at GSP> prompt. This will simulate a system crash and will write a crash dump. Provided you have enough space under /var/adm/crash, and a support agreement with HP, you can send this dump to them on a tape and they can tell you better than anyone else, what is causing the zombie process, if there is a way to determine it.

Of course this needs to be planned in advance to prevent any data corruption.

[Bill Hassell]

Poor programming techniques are the most common cause for zombies or defunct programs. You can't kill the program because it is already dead (hence the name: zombie). It consumes no resources, not even memory. It's just an entry in the process table. Start figuring out the cause by finding the parent:

root 29937 2600 ...

You know it's a root program, probably started by a startup script. The PPID is 2600, so look at the name of that process:

ps -fp 2600

It may not exist, but if it does, that is the problem program. When one program starts another, it is the responsibility of the parent to either assign that program to init or to wait until the child program terminates and then perform the appropriate cleanup tasks. Since a standard HP-UX system doesn't create any zombies at startup, look at the add-on startup tasks in /sbin/init.d and possibly /etc/inittab.

[Carlos Munoz Lopez]

Ok, thank you guys. I will generate the crash dump and send it to HP Support if the zombie process shows up again next time I reboot the system. Thanks for all your help.

[Joel Girot]

Carlos,

on hpux 11.11 (and 11.23 ?) if the defunct process is a child of the ia64_corehw process, it's not a real zombie, it is the normal operation for ia64_corehw.

Joel

[Muthukumar_5]

In 11.11 os there is a process called
/usr/sbin/stm/uut/bin/tools/monitor/ia64_corehw will create a defunct process (Zombie) always.

# ps -efxl | grep -i defunct
1 Z root 7232 2545 0 178 20 450edb80 0 - 01:54:37 ? 0:00
# ps -efxl | grep -i ia64
1 S root 2545 1 0 154 20 4505a100 397 bb2300 Oct 10 ? 3:20 /usr/sbin/stm/uut/bin/tools/monitor/ia64_corehw

It is default so that don't worry.

hth.

[Arunvijai_4]

If you have STM installed, it will create defunct process. Anyways, its a bug. you can check for patches in ITRC soon..

-Arun

[Andrew Merritt_2]

The child of ia64_corehw is not a bug as such, and it is not planned to be fixed in a patch to the OnlineDiags.

You can check that this is what you're seeing by a) checking the parent process, which will be ia64_corehw, and b) noticing that in fact it's a new process every minute.

This process is using no resources apart from a process slot, and is just waiting to be cleaned up by its parent.

There will be some changes in a future release of the OnlineDiags that will mean that on most systems the process will not appear.

Andrew