Orphan vs Zombie vs Daemon processes | gmarik.info

Orphan Process

An orphan process is a computer process whose parent process has finished or terminated, though it remains running itself.

In a Unix-like operating system any orphaned process will be immediately adopted by the special initsystem process. 
This operation is called re-parenting and occurs automatically. Even though technically the process has the init process as its parent, it is still called an orphan process since the process that originally created it no longer exists.

A process can be orphaned unintentionally, such as when the parent process terminates or crashes. The process group mechanism in most Unix-like operation systems can be used to help protect against accidental orphaning, where in coordination with the user's shell will try to terminate all the child processes with the SIGHUP process signal, rather than letting them continue to run as orphans.

A process may also be intentionally orphaned so that it becomes detached from the user's session and left running in the background; usually to allow a long-running job to complete without further user attention, or to start an indefinitely running service. 
Under Unix, the latter kinds of processes are typically called daemon processes. The Unix nohup command is one means to accomplish this.

http://www.geekride.com/orphan-zombie-process/

Finding a Orphan Process: ppid is 1

ps -elf | head -1; ps -elf | awk '{if ($5 == 1 && $3 != "root") {print $0}}' | head

Are Orphan processes harmful for system ?

A. Yes. Orphan processes take resources while they are in the system, and can potentially leave a server starved for resources. 

Having too many Orphan processes will overload the init process and can hang-up a Linux system. We can say that a normal user who has access to your Linux server is capable to easily kill your Linux server in a  minute.

Zombie Process
a zombie process or defunct process is a process that has completed execution but still has an entry in the process table.

When a process ends, all of the memory and resources associated with it are deallocated so they can be used by other processes. However, the process's entry in the process table remains. The parent can read the child's exit status by executing the wait system call, whereupon the zombie is removed. 

The wait call may be executed in sequential code, but it is commonly executed in a handler for the SIGCHLD signal, which the parent receives whenever a child has died.

After the zombie is removed, its process identifier (PID) and entry in the process table can then be reused. 
However, if a parent fails to call wait, the zombie will be left in the process table. 

In some situations this may be desirable, for example if the parent creates another child process it ensures that it will not be allocated the same PID.

if the parent explicitly ignores SIGCHLD by setting its handler toSIG_IGN (rather than simply ignoring the signal by default) or has the SA_NOCLDWAIT flag set, all child exit status information will be discarded and no zombie processes will be left

A zombie process is not the same as an orphan process. An orphan process is a process that is still executing, but whose parent has died. They do not become zombie processes; instead, they are adopted by init (process ID 1), which waits on its children.

http://www.geekride.com/zombie-process-defunct-linux
When does a process turn into a zombie?
Normally, when a process finishes execution, it reports the execution status to its parent process. Until the parent process decides that the child processes exit status is not needed anymore, the child process turns into a defunct or zombie process. It does not use resources and it cannot be schuduled for execution. Sometimes the parent process keeps the child in the zombie state to ensure that the future children processes will not receive the same PID.

You can find the zombie processes with ps aux | grep Z. The processes with Z in the STATE field are zombie processes:
$ ps aux | grep Z

Killing a Zombie Process:
# kill -s SIGCHLD <PPID>
or kill  -17 <PPID>
Even if this don’t work, then the last option you will have is to kill the parent process. You can easily find out the parent’s process ID with this command:

# ps aux -eo ppid | grep <Zombie Process ID>
# kill -9 <PPID>
So when a Zombie process loses it’s parent process, it becomes orphan and adopted by “init”. Init periodically executes the wait system call to reap any zombies with init as parent.

Is it bad to have Zombie processes on your system ?
A. Well, as Zombie processes are not taking any resources of your system, leaving a small entry in process table, it’s not at all harmful to have Zombie processes in your system, but it may hurt you sometime under heavy load. So, it’s always better not to have them.

Daemon Process

 daemon is a computer program that runs as a background process, rather than being under the direct control of an interactive user. Typically daemon names end with the letter d: for example, syslogd is the daemon that implements the system logging facility and sshd is a daemon that services incoming SSH connections.

In a Unix environment, the parent process of a daemon is often, but not always, the init process. A daemon is usually created by a process forking a child process and then immediately exiting, thus causinginit to adopt the child process. In addition, a daemon or the operating system typically must perform other operations, such as dissociating the process from any controlling terminal (tty). 

Daemon process is a process orphaned intentionally.

Parent Process

every process except process 0 (the swapper) is created when another process executes the fork() system call. The process that invoked fork is the parent process and the newly-created process is the child process. Every process (except process 0) has one parent process, but can have many child processes.

The operating system kernel identifies each process by its process identifier. Process 0 is a special process that is created when the system boots; after forking a child process (process 1), process 0 becomes the swapper process (sometimes also known as the "idle task"). Process 1, known as init, is the ancestor of every other process in the system.

Chile Process

A child process in computing is a process created by another process (the parent process).

A child process inherits most of its attributes, such as open files, from its parent. In UNIX, a child process is in fact created (using fork) as a copy of the parent. The child process can then overlay itself with a different program (using exec) as required.

Each process may create many child processes but will have at most one parent process; if a process does not have a parent this usually indicates that it was created directly by the kernel. In some systems, including UNIX based systems such as Linux, the very first process (called init) is started by the kernel at booting time and never terminates (see Linux startup process); other parentless processes may be launched to carry out various daemon tasks in userspace. Another way for a process to end up without a parent is if its parent dies, leaving an orphan process; but in this case it will shortly be adopted by init.

http://www.geeksforgeeks.org/zombie-processes-prevention/

Zombie state : When a process is created in UNIX using fork() system call, the address space of the Parent process is replicated. If the parent process calls wait() system call, then the execution of parent is suspended until the child is terminated. At the termination of the child, a ‘SIGCHLD’ signal is generated which is delivered to the parent by the kernel. Parent, on receipt of ‘SIGCHLD’ reaps the status of the child from the process table. Even though, the child is terminated, there is an entry in the process table corresponding to the child where the status is stored. When parent collects the status, this entry is deleted. Thus, all the traces of the child process are removed from the system. If the parent decides not to wait for the child’s termination and it executes its subsequent task, then at the termination of the child, the exit status is not read. Hence, there remains an entry in the process table even after the termination of the child. This state of the child process is known as the Zombie state.

Why do we need to prevent the creation of Zombie process?
There is one process table per system. The size of the process table is finite. If too many zombie processes are generated, then the process table will be full. That is, the system will not be able to generate any new process, then the system will come to a standstill. Hence, we need to prevent the creation of zombie processes.

Different ways in which creation of Zombie can be prevented
1. Using wait() system call : When the parent process calls wait(), after the creation of child, it indicates that, it will wait for the child to complete and it will reap the exit status of the child. The parent process is suspended(waits in a waiting queue) until the child is terminated. It must be understood that during this period, the parent process does nothing just waits.

int main()

{

    int i;

    int pid = fork();

    if (pid==0)

    {

        for (i=0; i<20; i++)

            printf("I am Child\n");

    }

    else

    {

        wait(NULL);

        printf("I am Parent\n");

        while(1);

    }

2. By ignoring the SIGCHLD signal : When a child is terminated, a corresponding SIGCHLD signal is delivered to the parent, if we call the ‘signal(SIGCHLD,SIG_IGN)’, then the SIGCHLD signal is ignored by the system, and the child process entry is deleted from the process table. Thus, no zombie is created. However, in this case, the parent cannot know about the exit status of the child.

int main()

{

    int i;

    int pid = fork();

    if (pid == 0)

        for (i=0; i<20; i++)

            printf("I am Child\n");

    else

    {

        signal(SIGCHLD,SIG_IGN);

        printf("I am Parent\n");

        while(1);

    }

}

3. By using a signal handler : The parent process installs a signal handler for the SIGCHLD signal. The signal handler calls wait() system call within it. In this senario, when the child terminated, the SIGCHLD is delivered to the parent.On receipt of SIGCHLD, the corresponding handler is activated, which in turn calls the wait() system call. Hence, the parent collects the exit status almost immediately and the child entry in the process table is cleared. Thus no zombie is created.

void func(int signum)

{

    wait(NULL);

}

 

int main()

{

    int i;

    int pid = fork();

    if (pid == 0)

        for (i=0; i<20; i++)

            printf("I am Child\n");

    else

    {

        signal(SIGCHLD, func);

        printf("I am Parent\n");

        while(1);

    }

}

Read full article from Orphan vs Zombie vs Daemon processes | gmarik.info