What is a Zombie Process and Should I be Worried That I Have Some?

The first thing is that you don't need to worry about zombie processes unless you have a great many of them (more than, say, 100).

Briefly: (from the HP Book, "HP Certified")

When a process terminates is calls the exit() system call. At this time the kernel releases resources used by the process. The process becomes a zombie and stays in that state until

Not so Briefly:

A process finishes when it calls the [tt]exit[/tt] system call with a parameter to tell its parent process, the process that started it off, whether it was sucessful or not.

When this happens the kernel releases everything used by that process, except, that is, its slot in the process table.

At this point the process is a Zombie process; it has completed and the only thing left is its entry in the system process table. It will stay a zombie until the thing that started the process in the first place (called the parent process) checks on that entry in the process table.

That entry is left there so that the parent process can pick up that [tt]exit[/tt] parameter and find out whether its child succeeded or not.

The parent does this by calling the [tt]wait[/tt] system call. The parent might not do this until much later and it might already have done this while its child, the process we're talking about, was still running. You see this sort of thing quite a lot, in Perl for instance as in this short fragment of a larger script.
[tt]
if($child_pid = fork()){
#[tab]this is still the parent process
#[tab]so all I need to do is hang around
#[tab]for my child process to complete,
#[tab]pick up its final return value
#[tab]and then exit myself
[tab]wait($child_pid);
[tab]exit(0);
} else {
#[tab]I'm running as the child process now
#[tab]so I'll do lots of useful work
#[tab]and then finish up and pass a zero exit
#[tab]code so that my parent knows it all
#[tab]went ok
exit(0);
}
[/tt]
If you're not familiar with Perl or C that probably looks a bit daunting so, a quick explanation without delving too much into the [tt]fork[/tt] system call.

The first thing that fragment does is to call [tt]fork[/tt]. [tt]Fork[/tt] splits the current process into two exact copies of itself. One of these copies is the parent and one is the child - the obvious question is "Which one is which?"

Well, the [tt]fork[/tt] system call returns two different values. To the parent process it returns the Process ID (the PID) of the child process. To the child process it returns a zero.

This means that the line:
[tt]if($child_pid = fork()){[/tt]
only returns true for the parent...