Linux: How to find the list of daemon processes and zombie processes

Question

I tried checking on Google, but I couldn't find much information related to the actual question.

How do I get a consolidated list of zombie processes and daemon processes? How do I do it on different operating systems. Linux? AIX? Windows?

I am sure that, based on PID, we cannot identify the type of process. Running through a terminal might not help either.

Sifuentes

There's no way to identify daemon processes, but zombies have Z in the state column of ps. – Ludly

As a convention daemon processes have d at the end of their names i.e systemd, httpd etc. – Esparza

Answer 1

Try out this.

ps axo pid,ppid,pgrp,tty,tpgid,sess,comm |awk '$2==1' |awk '$1==$3'

In the above command I used the very properties of a daemon to filter them out, from all of existing processes in Linux.

The parent of a daemon is always Init, so check for ppid 1. The daemon is normally not associated with any terminal, hence we have ‘?’ under tty. The process-id and process-group-id of a daemon are normally same The session-id of a daemon is same as it process id.

Cleaning

Answer 2

With GNU ps on Linux:

[

$ ps --version

procps-ng version 3.3.3

]

Zombies:

ps -lA | grep '^. Z'

will get you all zombies (note that the param is lowercase 'L', i.e., 'l' followed by 'A').

Daemons:

As @Barmar said there's no way to get daemons for certain, but a clue that a process is a daemon is that it's not associated with any TTY device. The 12th column of 'ps -Al' output is TTY; the 4th is PID, 14th is the process name. Hence:

ps -lA | awk '$12 == "?" {print $4, $14}'

will get you processes that are possibly daemons; not guaranteed! :)

Rosenfeld

Answer 3

Daemons are started by the init process, which means they have a PPID of 1.

Therefore:

ps -ef | awk '$3 == 1'

Ti

But this will output those processes that are not daemons as well. Because, if a process parent dies before a child, that child is then parented by init(). – Eades

Answer 4

To get the list of Zombie and daemon process just write a psudo character dev driver, where you should navigate trough the task_struct and look for state

Droll

True, but: (a) more effort (b) you still won't know which is a daemon for sure – Rosenfeld

Would you please eloberate on "write a pseudo character dev driver"? Also, by navigating through task_struct, is it possible to identify a daemon process precisely. Meaning, for sure. No mismatches. – Sifuentes

Answer 5

I wrote for daemons and the "old" sysv initd, you have to check if it is working on your distro.

Good demons have well written startup scripts in /etc/initd

When changing runlevel, how does init know the running daemons ?

It looks for their names in the directory

/var/lock/subsys

So you can

• get the names list from there

• scan all the running processes and check if the name is inside the list: bingo !

To scan all the processes: list every subdirectory in

/proc

If its name is digits, it is the pid of a running process.

For example, the status of the process with pid 1234 is this file

/proc/1234/status

Open it and get the first line, starts with "Name:"

See

• http://man7.org/linux/man-pages/man5/proc.5.html

• https://linuxexplore.com/2014/03/19/use-of-subsystem-lock-files-in-init-script/

Antepast