Linux Process Monitoring: Detect Zombies & Track Resources with Python (2026)

Process management is one of the core skills every Linux sysadmin must master. Runaway processes consuming all available CPU, memory leaks that slowly degrade server performance, and zombie processes that indicate broken parent-child relationships — these issues demand constant vigilance.

This guide covers everything you need to know about Linux process monitoring, from basic ps and top commands to automated monitoring with dargslan-process-monitor, a free Python tool that reads directly from the /proc filesystem.

Understanding Linux Processes

Every running program on Linux is a process with a unique PID (Process ID). The kernel manages these processes through the /proc virtual filesystem, which contains real-time information about every process on the system.

Process States

• R (Running) — Currently executing on a CPU core or waiting in the run queue
• S (Sleeping) — Waiting for an event (I/O, timer, signal) — most processes are here
• D (Disk Sleep) — Uninterruptible sleep, usually waiting for I/O — cannot be killed
• Z (Zombie) — Process has finished but parent hasn't collected its exit status
• T (Stopped) — Suspended by a signal (SIGSTOP or Ctrl+Z)

Installing dargslan-process-monitor

pip install dargslan-process-monitor

# Or install the complete 15-tool sysadmin toolkit
pip install dargslan-toolkit

CLI Usage

# Quick process summary with zombie detection
dargslan-proc summary

# Find zombie processes
dargslan-proc zombies

# Top 15 memory consumers
dargslan-proc topmem -n 15

# Top CPU consumers
dargslan-proc topcpu

# Find specific processes
dargslan-proc find nginx

# Process count by state
dargslan-proc count

# JSON output for scripting
dargslan-proc json

Python API for Custom Monitoring

from dargslan_process_monitor import ProcessMonitor

pm = ProcessMonitor()

# Quick summary
pm.print_summary()

# Detect zombie processes
zombies = pm.find_zombies()
if zombies:
    print(f"WARNING: {len(zombies)} zombie processes found!")
    for z in zombies:
        print(f"  PID {z['pid']} (PPID {z['ppid']}): {z['name']}")

# Find memory-hungry processes
for p in pm.top_memory(10):
    print(f"  PID {p['pid']:>6}  {p['mem_human']:>10}  {p['name']}")

# Search for specific processes
nginx_procs = pm.find_by_name("nginx")
print(f"Found {len(nginx_procs)} nginx processes")

# Process state statistics
counts = pm.process_count()
print(f"Total: {counts['total']}, Running: {counts.get('Running', 0)}")

Understanding Zombie Processes

Zombie processes are one of the most misunderstood concepts in Linux. A zombie is a process that has completed execution but still has an entry in the process table because its parent process hasn't read its exit status using the wait() system call.

Why Zombies Are Created

• Parent process is poorly coded and doesn't call wait()
• Parent process is too busy to collect child exit status
• Parent process has a bug in its signal handler

How to Fix Zombie Processes

# Find zombies
ps aux | grep 'Z'

# Find the parent process
ps -eo pid,ppid,stat,comm | grep Z
# Look at the PPID column

# Send SIGCHLD to parent (tells it to collect zombie)
kill -SIGCHLD <PPID>

# If parent is unresponsive, killing parent removes zombies
kill -9 <PPID>

The /proc Filesystem Deep Dive

The /proc filesystem is a goldmine of process information. dargslan-process-monitor reads directly from /proc instead of shelling out to ps or top, making it faster and more reliable.

# Process status
cat /proc/<PID>/status

# Command line arguments
cat /proc/<PID>/cmdline | tr '\0' ' '

# Open file descriptors
ls -la /proc/<PID>/fd/

# Memory map
cat /proc/<PID>/maps

# System-wide info
cat /proc/loadavg
cat /proc/meminfo
cat /proc/cpuinfo

Essential Process Commands

# List all processes sorted by memory
ps aux --sort=-%mem | head -20

# List all processes sorted by CPU
ps aux --sort=-%cpu | head -20

# Process tree view
pstree -p

# Real-time monitoring
top -bn1 | head -25
htop  # Interactive version

# Kill by name
pkill nginx
killall nginx

# Send signals
kill -HUP <PID>   # Reload configuration
kill -USR1 <PID>  # Application-specific (often log rotation)
kill -TERM <PID>  # Graceful shutdown
kill -KILL <PID>  # Force kill (last resort)

Automated Process Monitoring

#!/usr/bin/env python3
# /opt/scripts/process-monitor.py
from dargslan_process_monitor import ProcessMonitor

pm = ProcessMonitor()

# Alert on zombies
zombies = pm.find_zombies()
if zombies:
    print(f"ALERT: {len(zombies)} zombie processes detected!")

# Alert on high memory processes (>1GB)
for p in pm.top_memory(5):
    if p['mem_kb'] > 1048576:
        print(f"ALERT: {p['name']} (PID {p['pid']}) using {p['mem_human']}")

# Check process count thresholds
counts = pm.process_count()
if counts['total'] > 500:
    print(f"WARNING: High process count: {counts['total']}")

Process monitoring is a fundamental sysadmin skill. With dargslan-process-monitor, you get a lightweight, dependency-free tool that reads directly from /proc — no heavy agents or monitoring platforms needed. Combine it with cron for automated zombie detection and resource alerts.

Install now: pip install dargslan-process-monitor — or get all 15 tools: pip install dargslan-toolkit

Download our free Process Monitor Cheat Sheet for quick reference.