Identify zombie processes on a Linux game server

A Linux zombie process is no longer executing code, but its entry stays visible until its parent process reaps its exit status. On a VPS — a virtual server hosted in a cloud infrastructure — a few isolated zombies do not necessarily mean a failure. An accumulation, on the other hand, deserves a methodical diagnosis from an SSH session.

Understand a zombie process

A process becomes a zombie when its execution is finished and its parent has not yet read its status. It normally no longer consumes CPU time or user memory like an active process. It does, however, keep an entry in the process table, along with a PID identifier. The phenomenon often comes from a parent program that does not handle the termination of its children correctly.

So do not confuse a zombie, a stuck process, and a resource-hungry process. For a game server, look separately at CPU load, RAM, disk I/O, disk space, and bandwidth. Find the administration basics in our guide to the first settings of a dedicated server.

Spot zombies with ps

Connect to the VPS over SSH, then look at the process list with your account's privileges:

ps -eo user,pid,ppid,stat,etime,cmd --sort=ppid

In the STAT column, the letter Z indicates a zombie process. The PID and PPID columns let you link the finished child to its parent. To quickly filter the relevant lines:

ps -eo pid,ppid,stat,cmd | awk '$3 ~ /^Z/'

Note the number of lines, the parent PIDs, and the command involved before taking any action. On Ubuntu or Debian, also check the systemd service that starts the server. On a Pterodactyl installation, identify the Docker container or the service that starts the process. Our Pterodactyl backups guide recalls why an intervention must preserve the server's data.

Assess the impact on the VPS

A one-off zombie can disappear when its parent finally performs the expected reaping. Watch the trend rather than immediately removing a PID. Run the command again after a few minutes and compare the number of zombies. If the list grows, look for a recent restart, a repeated error in the parent program, or a script that launches subprocesses without waiting for them.

In parallel, check the useful resources: uptime for CPU load, free -h for RAM and swap memory, df -h for filesystems, and df -i for inodes. Saturation of SSD storage, RAM, or the network can cause distinct symptoms. Read our Docker on a VPS guide if the server runs in container virtualization, and our method for diagnosing an unreachable VPS if the problem is actually network-related or tied to the IP address.

Act on the parent process

A zombie does not end with a simple kill like an active process: its code has already finished. The action must target the parent, carefully. Before any restart, identify the service, check its configuration, and warn the players if an interruption is possible. A controlled restart of the parent service often reaps the finished children, but it can interrupt the game server and its network ports.

Do not send a signal to a PID whose role you do not know. First use ps -p PID_PARENT -o pid,ppid,stat,cmd, then check the service's logs. For systemd units, journalctl -u nom-du-service helps find the errors around the appearance of the zombies. Make sure your root account or your administration user has the necessary privileges. Our security checklist can serve as a starting point to limit improvised interventions.

Prevent recurrence

Keep a simple measurement of the number of zombies, the VPS load, RAM usage, and disk space. Add an alert in your monitoring tool when the value rises continuously, then tie it to the parent service's logs. Update the software concerned according to its documentation and test the fix on a staging environment when possible. A recent backup remains essential before changing the service. Also discover our backup principles for dedicated servers.

The hosting context to check

Whether you host a Minecraft, FiveM, or Rust server on a Linux VPS, check the allocated operating system, processor, RAM, and disk space. A hosting provider sometimes provides a control panel or a managed solution to track these resources, but the SSH command and the system logs remain the reference for the parent process. A firewall does not explain a zombie, any more than a DNS or a domain name: those elements concern the network and access to the service, not the reaping of a process's state.

In a virtual machine or a cloud server, virtual servers share an infrastructure, while a dedicated server reserves its physical resources. To host a game, a private server, a virtual dedicated server, or a cloud VPS can provide different environments depending on the configuration and the hypervisor. This difference can matter during a migration or a change of VPS plan, but it does not change the diagnosis of processes.

The problem does not depend on shared hosting, an Apache web server, or a MySQL database: you must isolate the command actually responsible and check the operating system's logs.