In UNIX or Linux, what is a zombie process and when does it appear in the process table?

Introduction / Context:
Process management in UNIX and Linux involves creating child processes, waiting for them to finish, and cleaning up their resources. Sometimes, after a process finishes, an entry lingers in the process table. Such processes are called zombie processes. They are a common topic in operating systems courses and interviews, because they illustrate how parent-child relationships and resource cleanup work.

Given Data / Assumptions:

• Processes are created using fork() or similar mechanisms.
• When a child process finishes, it returns an exit status to its parent.
• The kernel keeps minimal information about the terminated child until the parent collects the status via wait() or waitpid().
• The question asks for the definition of a zombie process and when it appears in the process table.

Concept / Approach:
A zombie process is a process that has terminated, meaning it has stopped executing and released most of its resources, but still has an entry in the process table. This entry stores the exit code and accounting information until the parent process reads it using wait() or a related call. If the parent does not call wait(), the child remains in this zombie state. Zombies are different from normal sleeping or stopped processes because they can no longer run; they exist only as records waiting to be reaped.

Step-by-Step Solution:
Step 1: Recall that when a child process finishes, the kernel marks it as terminated and prepares an exit status for the parent.Step 2: The child's resources, such as memory and open file descriptors, are freed, but a small process table entry is retained so the parent can later retrieve the exit code.Step 3: While this entry is waiting to be collected, the process is said to be in a zombie state.Step 4: Once the parent calls wait() or waitpid() and reads the exit status, the kernel removes the process table entry and the zombie disappears.Step 5: Therefore, a zombie appears only after a process has finished execution and before the parent has reaped its status.

Verification / Alternative check:
System utilities such as ps or top can display zombie processes with a special state code, often "Z". Documentation for wait() and waitpid() describes how a terminated child remains as a zombie until the parent calls one of these functions. Tutorials on process management emphasize that failing to wait for children can cause an accumulation of zombies, which may eventually exhaust available process table entries. These descriptions match the understanding that zombies are finished processes whose exit status has not yet been collected.

Why Other Options Are Wrong:
Option B is incorrect because sleeping processes can wake up and continue running; they are not zombies. Option C is wrong because kernel threads that cannot be killed are not called zombies and do not match the definition of a terminated process waiting for reaping. Option D is incorrect because swapping a process out to disk is a normal part of virtual memory management and does not mean the process has finished execution or become a zombie.

Common Pitfalls:
Students often confuse zombie processes with orphan processes. An orphan process has a parent that has exited, so it is adopted by another ancestor, but it may still be running normally. A zombie, by contrast, has already exited and is merely waiting for its exit status to be collected. Another pitfall is to assume zombies always consume large amounts of memory. In reality, most resources are freed; the main concern is consuming entries in the process table.

Final Answer:
A zombie process is a process that has finished execution but remains in the process table because its parent has not yet collected its exit status.