Zombie process vs Orphan process

Question

A Zombie is created when a parent process does not use the wait system call after a child dies to read its exit status, and an orphan is child process that is reclaimed by init when the original parent process terminates before the child.

In terms of memory management and the process table how are these processes handled differently, specifically in UNIX?

What is an example or extreme case when the creation of zombies or orphans can be detrimental to the greater application or system?

Rabb

create a lot of zombies and watch your system ssssllooooowwww – Deland

There's no reason for a zombie process to consume (a non trivial amount of) memory... it's dead. It's basically a placeholder so that the parent can still read the exit status at some point in the future. – Malcolm

The zombie isn't occupying any significant memory or resources, it's (effectively) only an exit status waiting to be delivered. An orphan is a live, running process just like any other -- it just has a peculiar name. – Quantum

@clintp but an orphan cannot become a zombie process since the OS will handle it once it completes? – Rabb

If there's a bug in the init process, or a kernel bug that prevents init from working properly, an orphaned process could become a zombie. Otherwise no. But looking at it another way, every process that exits is a zombie until the parent cleans it up, so yes they do become zombies, but not for long. – Bronwynbronx

"an orphan is child process that is reclaimed" so it's not an orphan anymore! And as a process is always reclaimed after the parent died there never is an orphan. – Juarez

Answer 1

When a child exits, some process must wait on it to get its exit code. That exit code is stored in the process table until this happens. The act of reading that exit code is called "reaping" the child. Between the time a child exits and is reaped, it is called a zombie. (The whole nomenclature is a bit gruesome when you think about it; I recommend not thinking about it too much.)

Zombies only occupy space in the process table. They take no memory or CPU. However, the process table is a finite resource, and excessive zombies can fill it, meaning that no other processes can launch. Beyond that, they are bothersome clutter, and should be strongly avoided.

If a process exits with children still running (and doesn't kill its children; the metaphor continues to be bizarre), those children are orphans. Orphaned children are immediately "adopted" by init (actually, I think most people call this "reparenting," but "adoption" seems to carry the metaphor better). An orphan is just a process. It will use whatever resources it uses. It is reasonable to say that it is not an "orphan" at all since it has a parent, but I've heard them called that often.

init automatically reaps its children (adopted or otherwise). So if you exit without cleaning up your children, then they will not become zombies (at least not for more than a moment).

But long-lived zombies exist. What are they? They're the former children of an existing process that hasn't reaped them. The process may be hung. Or it may be poorly written and forgets to reap its children. Or maybe it's overloaded and hasn't gotten around to it. Or whatever. But for some reason, the parent process continues to exist (so they aren't orphans), and they haven't been waited on, so they live on as zombies in the process table.

So if you see zombies for longer than a moment, then it means that there is something wrong with the parent process, and something should be done to improve that program.

Hodge

Answer 2

When a process terminates, its resources are deallocated by the operating system. However, its entry in the process table must remain there until the parent calls wait(), because the process table contains the process’s exit status. A process that has terminated, but whose parent has not yet called wait(), is known as a zombie process. All processes transition to this state when they terminate, but generally they exist as zombies only briefly. Once the parent calls wait(), the process identifier of the zombie process and its entry in the process table are released.

Now consider what would happen if a parent did not invoke wait() and instead terminated, thereby leaving its child processes as orphans. Linux and UNIX address this scenario by assigning the init process as the new parent to orphan processes. The init process periodically invokes wait(), thereby allowing the exit status of any orphaned process to be collected and releasing the orphan’s process identifier and process-table entry.

Source: Operating System Concepts by Abraham, Peter, Greg

Esplanade

Really liked this short and crisp answer. – Guajardo

So in fact there are no orphans, as they get adopted. – Juarez

Answer 3

An orphan process is a computer process whose parent process has finished or terminated, though it (child process) remains running itself.
A zombie process or defunct process is a process that has completed execution but still has an entry in the process table as its parent process didn't invoke an wait() system call.

Ariannaarianne

Answer 4

Orphan - Parent exit , Init process becomes the parent of child process. Whenever child is terminated, process table gets deleted by os.

Zombie - When the child terminates it gives exit status to parent. Meanwhile time suppose your parent is in sleep state and unable to receive any status from child. Though the child exit but the process occupies space in process table

check out this command in linux ubuntu >>ps -eo pid,ppid,status,cmd

If you found something like defunc at the end i.e your process is zombie and occupying space.

Zwart

Answer 5

Zombie Process: A process that has finished the execution but still has an entry in the process table to report to its parent process is known as a zombie process. A child process always first becomes a zombie before being removed from the process table. The parent process reads the exit status of the child process which reaps off the child process entry from the process table.

Orphan Process: A process whose parent process no more exists i.e. either finished or terminated without waiting for its child process to terminate is called an orphan process.

Sylph

Answer 6

Summary

• Zombie process is a child process that has completed execution but still has an entry in the process table, waiting for its parent to acknowledge its termination
• Orphan process is a child process whose parent has terminated before it, and it is adopted by the init process.

---

What happens with the zombie processes?

• wait() system call is used for the removal of zombie processes, it ensures that the parent doesn't execute or sits idle till the child process is completed.
• When the child process completes executing, the parent process removes entries of the child process from the process table. This is called "reaping of the child".

What will happen with the orphan processes?

• In the real world orphans are adopted by guardians who look after them.
• Similarly, the orphan process in Linux is adopted by a new process, which is mostly init process (pid=1). This is called re-parenting.
• Reparenting is done by the kernel when the kernel detects an orphan process in os and assigns a new parent process.
• New parent process asks the kernel for cleaning of the PCB of the orphan process and the new parent waits till the child completes its execution.

---

Zombie Process	Orphan Process
A Zombie is a process that has completed its task but still, shows an entry in a process table.	A child process that remains running even after its parent process is terminated or completed without waiting for the child process execution is called an orphan.
Zombie process states always indicated by Z	The orphan process was created unknowingly due to a system crash.
The zombie process is treated as dead they are not used for system processing	An orphan process is a computer process even after its parent terminates init it becomes a parent and continues the remaining task.
wait() system call is used to deal with zombie processes	Kernel allocates a new process as parent process to orphan process. Mostly the new parent is the init process (pid=1).
To remove the zombie process executes the kill command.	Terminate the Orphan process using the SIGHUP signal.

---

Source:

• Zombie vs. Orphan Processes
• Difference between zombie orphan and daemon processes
• Zombie and Orphan Process in OS

Upend

Answer 7

1. There are no orphans but the process using PID 1.

   From the running process' point of view it makes no difference whether it was started directly and therefore has PID 1 as parent or got inherited by PID 1 because its original parent (being different from PID 1) ended. It is handled like any other process.

2. Each process goes through some sort of zombie state, when ending, namely the phase between announcing its end by issuing SIGCHLD and having its processing (delivery or ignorance) acknowledged.

When the zombie state had been entered the process is just an entry in the system's process list.

The only significant resource a zombie is exclusively using is a valid PID.

Juarez

Answer 8

I would like to add 2 code snippets featuring an orphan and a zombie process. But first, I will post the definition of these processes as stated in the book "Operating System Concepts" by Silberschatz, Galvin and Gagn:

If no parent waiting (did not invoke wait()) process is a zombie

If parent terminated without invoking wait , process is an orphan

Orphan

// A C program to demonstrate Orphan Process.  
// Parent process finishes execution while the 
// child process is running. The child process 
// becomes orphan. 

#include <stdio.h>  //printf
#include <stdlib.h> //exit
#include <sys/types.h> //fork
#include <unistd.h> //fork and sleep
  
int main() 
{ 
    // Fork returns process id 
    // in parent process 
    pid_t child_pid = fork(); 
  
    // Parent process didn't use wait and finished before child
    // so the child becomes an orphan process

    // Parent process 
    if (child_pid > 0) {
        printf("I finished my execution before my child"); 
    }
    else // Child process 
        if (child_pid == 0) { 
            sleep(1); //sleep for 1 second
            printf("This printf will not be executed"); 
        } 
        else{
            //error occurred
        }
  
    return 0; 
}

Output

I finished my execution before my child

Zombie

// A C program to demonstrate Zombie Process. 
// Child becomes Zombie as parent is not waiting
// when child process exits. 

#include <stdio.h>  //printf
#include <stdlib.h> //exit
#include <sys/types.h> //fork
#include <unistd.h> //fork and sleep

int main() 
{ 
    // Fork returns process id 
    // in parent process 
    pid_t child_pid = fork(); 
 
    // Parent process didn't use wait 
    // so the child becomes a zombie process

    // Parent process 
    if (child_pid > 0){ 
        sleep(1); //sleep for 1 second
        printf("\nI don't wait for my child");
    }
    else // Child process 
        if(child_pid == 0){ 
            printf("My parent doesn't wait me");
            exit(0);
        }
        else{
            //error occurred
        }
    
    return 0; 
} 

Output

My parent doesn't wait me

I don't wait for my child

Edit: Source and inspiration taken from here

Vermis

Answer 9

A process which has finished the execution but still has the entry in the process table to report to its parent process is known as a zombie process. A process whose parent process no more exists i.e. either finished or terminated without waiting for its child process to terminate is called an orphan process

Marlonmarlow