Linux: How to find the list of daemon processes and zombie processes

Question

I tried checking on Google, but I couldn't find much information related to the actual question.

How do I get a consolidated list of zombie processes and daemon processes? How do I do it on different operating systems. Linux? AIX? Windows?

I am sure that, based on PID, we cannot identify the type of process. Running through a terminal might not help either.

There's no way to identify daemon processes, but zombies have `Z` in the state column of `ps`. — Barmar, Aug 01 '13 at 10:11
As a convention daemon processes have d at the end of their names i.e systemd, httpd etc. — Osman, Feb 09 '22 at 21:24

score 17 · Answer 1 · edited Jun 26 '14 at 11:43

Try out this.

ps axo pid,ppid,pgrp,tty,tpgid,sess,comm |awk '$2==1' |awk '$1==$3'

In the above command I used the very properties of a daemon to filter them out, from all of existing processes in Linux.

The parent of a daemon is always Init, so check for ppid 1. The daemon is normally not associated with any terminal, hence we have ‘?’ under tty. The process-id and process-group-id of a daemon are normally same The session-id of a daemon is same as it process id.

score 10 · Answer 2 · answered Aug 02 '13 at 03:44

With GNU ps on Linux:

[

$ ps --version

procps-ng version 3.3.3

]

Zombies:

ps -lA | grep '^. Z'

will get you all zombies (note that the param is lowercase 'L', i.e., 'l' followed by 'A').

Daemons:

As @Barmar said there's no way to get daemons for certain, but a clue that a process is a daemon is that it's not associated with any TTY device. The 12th column of 'ps -Al' output is TTY; the 4th is PID, 14th is the process name. Hence:

ps -lA | awk '$12 == "?" {print $4, $14}'

will get you processes that are possibly daemons; not guaranteed! :)

score 4 · Answer 3 · answered Sep 21 '13 at 01:09

4

Daemons are started by the init process, which means they have a PPID of 1.

Therefore:

ps -ef | awk '$3 == 1'

answered Sep 21 '13 at 01:09

Ann B

41
2

But this will output those processes that are not daemons as well. Because, if a process parent dies before a child, that child is then parented by init(). – Arjun J Rao Jan 28 '14 at 07:03

score 1 · Answer 4 · answered Aug 01 '13 at 18:41

1

To get the list of Zombie and daemon process just write a psudo character dev driver, where you should navigate trough the task_struct and look for state

answered Aug 01 '13 at 18:41

True, but: (a) more effort (b) you still won't know which is a daemon for sure – kaiwan Aug 02 '13 at 03:44
Would you please eloberate on "write a pseudo character dev driver"? Also, by navigating through task_struct, is it possible to identify a daemon process precisely. Meaning, for sure. No mismatches. – kris123456 Aug 12 '13 at 10:15

score -1 · Answer 5 · edited Apr 02 '20 at 22:17

I wrote for daemons and the "old" sysv initd, you have to check if it is working on your distro.

Good demons have well written startup scripts in /etc/initd

When changing runlevel, how does init know the running daemons ?

It looks for their names in the directory

/var/lock/subsys

So you can

get the names list from there
scan all the running processes and check if the name is inside the list: bingo !

To scan all the processes: list every subdirectory in

/proc

If its name is digits, it is the pid of a running process.

For example, the status of the process with pid 1234 is this file

/proc/1234/status

Open it and get the first line, starts with "Name:"

See

Linux: How to find the list of daemon processes and zombie processes

5 Answers5