Process States Explained

Process States Explained

Every process is always in one of a small set of states. The state tells you what the process is doing right now: running on a CPU, waiting for I/O, sleeping, stopped for debugging, or waiting to be cleaned up. Reading process states correctly is key to understanding what is wrong when a system is slow, unresponsive, or behaving unexpectedly.

The Linux process states

Process lifecycle:

  [Created/Fork] → R (Runnable) → CPU assigned → Running
                        ↑              |
                        |        sleep syscall, I/O wait
                        |              ↓
                        ←──── S (Interruptible Sleep)
                        ←──── D (Uninterruptible Sleep) ← I/O in progress
                              |
                        I/O completes → back to R

  Signal received → T (Stopped) → SIGCONT → R
  Process exits  → Z (Zombie) → parent wait() → process removed
                                 if parent never calls wait() → stuck zombie

Identifying process states

# See the state column in ps output
ps aux | head -5

ps output with STAT column

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1 169320  8234 ?        Ss   Jun01   0:03 /sbin/init
mysql     1234  0.5  2.3 786432 45678 ?        Sl   Jun01   2:15 mysqld
irfan     5678  0.0  0.0  10432  2048 pts/0    S+   14:00   0:00 bash
nobody    6789  0.0  0.0      0     0 ?        Z    Jun01   0:00 [defunct]

Additional state modifier characters appended after the state:

# Count processes in each state
ps aux | awk '{print $8}' | sort | uniq -c | sort -rn

# Find all zombie processes
ps aux | grep "^.*Z.*defunct"

# Find all processes in D state (waiting for I/O)
ps aux | awk '$8 ~ /^D/ {print}'

# Watch for D-state processes (I/O bottleneck indicator)
watch -n1 "ps aux | awk '\$8 ~ /^D/ {print}'"

Zombie processes

A zombie is a process that has finished executing but still has an entry in the process table because its parent has not read its exit status via wait(). Zombies consume no CPU or memory — only a PID entry. A small number are normal. Large numbers indicate a programming bug in the parent process.

# Count zombies
ps aux | grep -c "^.*Z"

# Find which parent is responsible for zombies
ps -el | awk 'NR==1 || $2 == "Z" {print}'

# Get the PPID of zombie processes, then check the parent
ZOMBIE_PPID=$(ps -el | awk '$2=="Z" {print $5}' | head -1)
ps -p $ZOMBIE_PPID -o pid,ppid,comm

# Fix: The only real fix is to restart the parent process
# Zombies disappear when the parent calls wait() or when the parent dies
# (then systemd/init adopts and reaps them)

Uninterruptible sleep (D state)

# D-state processes are serious — they cannot be killed
# Cause: waiting for I/O that is not completing (stuck NFS mount, failing disk)

# Find D-state processes
ps aux | awk '$8 ~ /^D/'

# What is the process waiting for? (stack trace)
sudo cat /proc/PID/wchan      # Shows kernel function it's waiting in
sudo cat /proc/PID/stack      # Full kernel stack trace

# Check for I/O issues
iostat -xd 2
dmesg | grep -E "error|I/O|timeout" | tail -10

# If caused by unresponsive NFS: try unmounting lazily
sudo umount -l /mnt/nfs    # Lazy unmount detaches the mount

Conclusion

In normal operation, most processes are in state S (sleeping, waiting for input) or R (running). Watch for D-state processes during I/O performance problems — many D-state processes mean something is waiting on slow I/O (check iostat and dmesg). Zombies (Z) are harmless in small numbers but in large quantities indicate a parent process bug. A process in D state cannot be killed with kill -9 — it must finish its I/O or the system must be rebooted.