Zombie Processes hangs unless Windows has been freshly restarted

[samaursa]

Brief description of your issue

When running the Zombie Processes scan on a Windows session that is long running, the Zombie Processes tab hangs presumably because of the sheer number of the processes.

For example, this is what I get after a Windows session (i.e. after restart) that is about 20 minutes long. There are over 10k terminated processes. It took System Informer about 1min to populate this window.

I tried the same with a Windows session where I hadn't restarted for almost a day and I gave the Zombie Processes window over 10 minutes to populate before killing the process. I am interested in Zombie Processes and not the terminated processes. Is it possible to improve the performance of the Scan by ignoring the terminated processes (at least allowing the user to have the option to not show terminated processes)?

Steps to reproduce (optional)

Run a scan of the Zombie Processes on a Windows session that is a few hours running without a restart.

Expected behavior (optional)

No response

Actual behavior (optional)

No response

Environment (optional)

System Informer 3.1.24298.0
Windows 11

[dmex]

Those terminated processes are also zombies. Something is keeping them alive and 10,000 after 24 hours indicates a severe issue.

[MagicAndre1981]

Are you using SI to scan for zombie processes because have a huge memory leak? I only see a few processes (EdgeWebView2, the mail app of Windows and svchost.exe) after running for several hours. Do you a 3rd party AV suite or any other hardening tool that may prevent closing handles to free memory?

[samaursa]

Wow okay. This is the first time I am looking at Zombie processes, so I have no baseline on what's normal.

Those terminated processes are also zombies

Zombies, as-in, they are still running? If not, and they are terminated, that's still a problem?

Are you using SI to scan for zombie processes because have a huge memory leak?

That's right. I have 128GB of RAM and it eventually gets filled up almost to the brim. However, if I (roughly) tally up the memory consumed by processes from the task manager, it is almost an order of magnitude lower.

git.exe and git-credentialhelper show up a lot. There were in the hundreds if not thousands on my last run (although I used RamMap for that because System Informer would just hang on the Zombie Processes window with that many zombie processes).

Thanks for the help on this, I appreciate it!

[dmex]

Zombies, as-in, they are still running? If not, and they are terminated, that's still a problem?

The kernel can't destroy the process while something has a reference and something is referencing all those process objects preventing the system from cleaning up/destroying those objects. Process termination is also asynchronous, the operating system queues a special termination APC and flags the process for termination but doesn't wait for termination to complete, so the process can continue waiting or executing in the kernel for some time before terminating.

[MagicAndre1981]

are you using the latest Git for Windows release? If you use the latest version, submit it their bugtracker.

[diversenok]

Git shows up a lot because it spawns many processes. It's clearly not the culprit.

@samaursa, if you right click on the process table header and enable the Handles column, is there a process that keeps a lot of handles open? If you find one, you can inspect which handles it has and if most of them are terminated process/thread handles, it's ought to be related to the source of the issue (by keeping all of them in a zombie state).