I have a peculiar problem. My server supports multiple ssh session simultaneously, so that multiple admins can manage (via command line interface) it simultaneously. We have a command which calls ztail to show the compressed log files. Now when the current ssh session is closed (without pressing Ctrl-C, to stop the ztail command), this command should ideally stop working. But what I observed when I start a new ssh session that, the process (ztail) is still running in background and consuming my CPU, even though the previous session was closed. Now how can I know when the session was closed, so that I can use that variable/flag to close/stop any commands initiated by that previously closed session?

  • This normally happens automatically, so ztail must be doing something to prevent dying. Programs started in an SSH session receive a SIGHUP when the session terminates. What is this ztail program, and how is it started? Commented Nov 11, 2012 at 20:28

2 Answers 2


This only happens if you run ztail (or any other command) as a new root-level process (i.e. without a parent process), e.g. in the background or via cron.

Usually when you start a standard ssh session you get a shell process, which is the root process for all programs you start. If the ssh session terminates, the kernel kills all child processes as well. (That's why people usually use screen or comparable things to retain sessions.)

So the easiest thing for you would be to utilize this default behavior. Have a look at ps axjf to check what ztail's root process is, then figure out why it survives the terminated ssh session.

  • 3
    "If the ssh session terminates, the kernel kills all child processes as well." Not exactly. The kernel sends a SIGHUP to the process group when the controlling terminal disappears, or the session leader dies creating an orphaned process group. It is likely ztail is either affecting sessions/process groups with setpgid or setsid, or ignoring SIGHUP. See chapter 9 in APUE for all the gory details.
    – Jim Paris
    Commented Nov 11, 2012 at 20:18

During the ssh-session a shell-session will be a child process. That child process will have another child process: ztail. After closing the shell ztail will loose its parents. As with all these processes, they will be adoped by init with PID 1.

To if the parent-pid of ztailis 1, it is most probably one of your "zombies".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .