`ps -ef` shows a process in state Z whose command is displayed as `<defunct>`. Sending it SIGKILL changes nothing. What is happening, and what removes the entry?
LPIC-1 Exam 101-500, objective 103. GNU and Unix commands hard
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct The process has already terminated and is waiting for its parent to collect its exit status; the entry disappears once the parent calls wait(), so signal or restart the parent.
Correct. A zombie holds nothing but a process table slot and an exit status. It cannot be killed because it is not running, and when the parent dies, init or systemd adopts and reaps it.
Not correct The process is in uninterruptible sleep inside a driver and must be woken by clearing the I/O it is blocked on.
Wrong. That is state D, not Z. D processes are alive and genuinely ignore signals until the kernel call they are in returns.
Not correct The process was stopped by SIGSTOP and needs SIGCONT before any other signal takes effect.
Wrong. A stopped process shows state T, and SIGKILL takes effect on it regardless of SIGCONT.
Not correct The process has been swapped out and will respond once memory pressure eases.
Wrong. Being paged out has no bearing on signal delivery, and ps does not report it as Z.
Why
The state column of ps uses R for running or runnable, S for interruptible sleep, D for uninterruptible sleep, T for stopped, and Z for a zombie. A zombie is a process that has exited but whose parent has not yet read its status with wait(), so the kernel keeps the entry alive to hold that status. Signals do not apply to a process that is already dead; the cure is always to deal with the parent, after which the zombie is reaped immediately.
Where this comes from
- Cited
- manual page ps(1)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 103 and space the ones you get wrong.
More questions on this objective
- A user starts a new terminal window in a running graphical desktop session, which launches bash as an interactive shell that is NOT a login shell. Which file in the user's home directory does bash read in that case? machine-checked
- In bash, which history expansion re-runs the entire previous command line? machine-checked
- Which bash command prints the literal five characters $USER instead of the current user name? machine-checked
- You want /opt/bin searched for executables, after all the directories already in PATH, in the current bash session and in every command started from it. Which command does that? machine-checked
- There is a passwd manual page in section 1 (the command) and another in section 5 (the /etc/passwd file format). Which command opens the section 5 page? machine-checked
- Select the TWO true statements about shell variables and the environment in bash. machine-checked