diffrence between zombie and orphan process

Zombie Process :
---------------------

If the child process is dead but its parent process is alive, the child process is declared zombie, means if you run ps aux, you will see that the just died child process is having a Z in the STAT column.

>> It does not use resources and it cannot be scheduled for execution. 

Sometimes the parent process keeps the child in the zombie state to ensure that the future children processes will not receive the same PID

$ ps aux | grep Z

Orphan Process :
---------------------

If parent process is dead but its child process is alive, the child process is declared orphan, means it is now adopted by its new parent .. the init process.

An Orphan Process is a process whose parent is dead (terminated). A process with dead parents is adopted by the init process.
When does a process become an orphan process?
Sometimes, when a process crashes, it leaves the children processes alive, transforming them into orphan processes. A user can also create a orphan process, by detaching it from the terminal.

How to find orphaned processes:
This command will not display only the orphaned processes, but all the processes having the PPID 1 (having the init process as it’s parent).

ps -elf | head -1; ps -elf | awk '{if ($5 == 1) {print $0}}'

The command snapshots all the processes with PPID 1. Keep that result. Thereafter, you may periodically run the command to compare the result of the time with snapshot taken earlier. Any differences found in the new snapshot might be potentially being orphan processes.

Note, the differences found are only suggest that they’re potential (not confirm) orphan processes in Linux system. You have to get more info to confirm them before terminating those processes. For example, how STIME figure, CPU utilization, understanding its purpose of executing, etc.

Once you have confirm them, you should not hesitate to terminate them as soon as possible, by the kill -9 command, as orphan processes will drain out your Linux system resources over the time.

>> Orphan processes use a lot of resources, so they can be easily found with top or htop. 

To kill an orphaned process, use kill -9 PID.