How do I know when a process has been killed

Question

The following code starts a lenghty nmap process and then the main program tries to kill it. I am running it from shell and also have GTOP running in another window just to see if all is successfull.

#include<stdio.h>
#include<string.h>
#include<stdlib.h>
#include<unistd.h>
#include<errno.h>
#include <sys/wait.h>

int main()
{
int ret,childpid=0;
ret = fork();
if (ret == 0)
   {
   printf("Here A %d.. \n", ret);
   char *params[5]  = {"nmap","-sS","-A","192.168.0.1/24",0}; //cmd params filled
   childpid = execv( "/usr/bin/nmap" , params);  //parameters for cmd
   printf("\n child exiting (%d) (%d).. \n", childpid,errno); //on successful execution of cmd, this exit never appears
   }
else
   {
   childpid=ret;  
   printf("parent exiting\n");
   if (childpid!=0)
      { 
      printf("child %d about to be killed wait 15 so that htop has time to see it\n",childpid);
      sleep(15);
      kill(childpid, SIGTERM);  
      sleep(2);
      kill(childpid, SIGKILL);
      printf("killed wait 15 HTOP should have time to update\n");
      sleep(15);
      }
   }
return 1;
}

HTOP see nmap starting but when I kill the process it still shows in the HTOP display. When my main program exit HTOP removes nmap from list of processes. Am I doing something wrong or misinterpreting HTOP?

Answer 1

You spawned a child process, killed it, and didn't wait(2) for it. The process is now a zombie, hanging around for its parent. When the parent process dies, the zombie becomes an orphan, and init takes care of it. From man 2 wait on Linux:

In the case of a terminated child, performing a wait allows the system to release the resources associated with the child; if a wait is not performed, then the terminated child remains in a "zombie" state (see NOTES below).

And from the notes:

A child that terminates, but has not been waited for becomes a "zombie". The kernel maintains a minimal set of information about the zombie process (PID, termination status, resource usage information) in order to allow the parent to later perform a wait to obtain information about the child. As long as a zombie is not removed from the system via a wait, it will consume a slot in the kernel process table, and if this table fills, it will not be possible to create further processes. If a parent process terminates, then its "zombie" children (if any) are adopted by init(1), (or by the nearest "subreaper" process as defined through the use of the prctl(2) PR_SET_CHILD_SUBREAPER operation); init(1) automatically performs a wait to remove the zombies.

So, wait() for the child process, or it will hang around until the parent process dies.

Answer 2

I think I found a solution. If I change the kill -part as follows:

      ...
      { 
      printf("child %d about to be killed wait 15 so that htop has time to see it\n",childpid);
      sleep(15);
      kill(childpid, SIGKILL);  
      waitpid(childpid,&ret,WUNTRACED);
      }
   }
return 1;
}

Adding that waitpid seems to clear the process from HTOP. If someone knows any caveat (why should I use SIGKILL instead of SIGTERM or should I use something else than WUNTRACED?) please let mr know.