PASSEDqueue / zombie_processes

ZeroMQ 4.3 Spawning Zombie Processes on Debian 12 Bookworm

ZeroMQ 4.3 is not reaping child processes, leading to thousands of zombie (defunct) processes. Process table filling up, new process creation at risk.

Pattern

PROCESS_CRASH_LOOP

Severity

HIGH

Confidence

72%

Remediation

Auto-Heal

Test Results

Metric	Expected	Actual
Pattern Recognition	PROCESS_CRASH_LOOP	PROCESS_CRASH_LOOP
Severity Assessment	MEDIUM	HIGH
Incident Correlation	N/A	None
Cascade Escalation	N/A	No
Remediation	—	Auto-Heal — Corax resolves autonomously

Scenario Conditions

Debian 12 Bookworm. ZeroMQ 4.3 PID 60771. 9372 zombie child processes. Process table usage at 85%. New fork() calls starting to fail.

Injected Error Messages (1)

ZeroMQ 4.3 crash loop spawning zombies on Debian 12 Bookworm — 9372 defunct child processes under PID 60771, process table 85% full, zeromq service restart fail, fork failures imminent

Neural Engine Root Cause Analysis

Process crash loop detected — a service is repeatedly crashing and restarting, failing to reach a stable running state. This indicates a persistent issue such as a missing dependency, corrupted configuration, incompatible library version, memory corruption, or an unhandled exception that occurs during startup. In Kubernetes environments, this manifests as CrashLoopBackOff with exponentially increasing restart delays.

Remediation Plan

1. Check service logs immediately before each crash for the error message or stack trace. 2. Look for core dumps in /var/crash/ or the configured core dump location. 3. Verify all dependencies (config files, environment variables, database connectivity) are available. 4. Roll back to the last known working version if the crash started after a deployment. 5. For segfaults, check for library version mismatches or corrupted binaries — reinstall the package.

Improvements Applied

Severity: HIGH (expected MEDIUM)

Tested: 2026-04-02Monitors: 1 | Incidents: 1Test ID: cmnhnqcl5065qlig75f0wqmdz