found zombie process which parent process is elastic-agent, after kill elastic-agent for a while, it automatically start and generate new zombie child process.
root@cdh1:~# ps -A -ostat,ppid,pid,cmd|grep elastic-agent
Ssl 1 12451 /opt/Elastic/Agent/elastic-agent
Zs 12451 12473 [elastic-agent] <defunct>
Sl 12451 12512 /opt/Elastic/Agent/data/elastic-agent-56a002/install/apm-server-8.4.0-linux-x86_64/apm-server -E management.enabled=true -E gc_percent=${APMSERVER_GOGC:100} -E logging.level=info -E http.enabled=true -E http.host=unix:///opt/Elastic/Agent/data/tmp/default/apm-server/apm-server.sock -E logging.files.path=/opt/Elastic/Agent/data/elastic-agent-56a002/logs/default -E logging.files.name=apm-server -E logging.files.keepfiles=7 -E logging.files.permission=0640 -E logging.files.interval=1h -E path.data=/opt/Elastic/Agent/data/elastic-agent-56a002/run/default/apm-server--8.4.0
Sl 12451 12522 /opt/Elastic/Agent/data/elastic-agent-56a002/install/filebeat-8.4.0-linux-x86_64/filebeat -E setup.ilm.enabled=false -E setup.template.enabled=false -E management.enabled=true -E logging.level=debug -E gc_percent=${FILEBEAT_GOGC:100} -E filebeat.config.modules.enabled=false -E logging.level=info -E http.enabled=true -E http.host=unix:///opt/Elastic/Agent/data/tmp/default/filebeat/filebeat.sock -E logging.files.path=/opt/Elastic/Agent/data/elastic-agent-56a002/logs/default -E logging.files.name=filebeat -E logging.files.keepfiles=7 -E logging.files.permission=0640 -E logging.files.interval=1h -E path.data=/opt/Elastic/Agent/data/elastic-agent-56a002/run/default/filebeat--8.4.0
Sl 12451 12530 /opt/Elastic/Agent/data/elastic-agent-56a002/install/metricbeat-8.4.0-linux-x86_64/metricbeat -E setup.ilm.enabled=false -E setup.template.enabled=false -E management.enabled=true -E logging.level=debug -E gc_percent=${METRICBEAT_GOGC:100} -E metricbeat.config.modules.enabled=false -E logging.level=info -E http.enabled=true -E http.host=unix:///opt/Elastic/Agent/data/tmp/default/metricbeat/metricbeat.sock -E logging.files.path=/opt/Elastic/Agent/data/elastic-agent-56a002/logs/default -E logging.files.name=metricbeat -E logging.files.keepfiles=7 -E logging.files.permission=0640 -E logging.files.interval=1h -E path.data=/opt/Elastic/Agent/data/elastic-agent-56a002/run/default/metricbeat--8.4.0
Sl 12451 12539 /opt/Elastic/Agent/data/elastic-agent-56a002/install/filebeat-8.4.0-linux-x86_64/filebeat -E setup.ilm.enabled=false -E setup.template.enabled=false -E management.enabled=true -E logging.level=debug -E gc_percent=${FILEBEAT_GOGC:100} -E filebeat.config.modules.enabled=false -E logging.level=info -E path.data=/opt/Elastic/Agent/data/elastic-agent-56a002/run/default/filebeat--8.4.0--36643631373035623733363936343635
Sl 12451 12571 /opt/Elastic/Agent/data/elastic-agent-56a002/install/metricbeat-8.4.0-linux-x86_64/metricbeat -E setup.ilm.enabled=false -E setup.template.enabled=false -E management.enabled=true -E logging.level=debug -E gc_percent=${METRICBEAT_GOGC:100} -E metricbeat.config.modules.enabled=false -E logging.level=info -E path.data=/opt/Elastic/Agent/data/elastic-agent-56a002/run/default/metricbeat--8.4.0--36643631373035623733363936343635
Sl 12451 19425 /opt/Elastic/Agent/data/elastic-agent-56a002/install/fleet-server-8.4.0-linux-x86_64/fleet-server --agent-mode -E logging.level=info -E http.enabled=true -E http.host=unix:///opt/Elastic/Agent/data/tmp/default/fleet-server/fleet-server.sock -E logging.files.path=/opt/Elastic/Agent/data/elastic-agent-56a002/logs/default -E logging.files.name=fleet-server -E logging.files.keepfiles=7 -E logging.files.permission=0640 -E logging.files.interval=1h -E path.data=/opt/Elastic/Agent/data/elastic-agent-56a002/run/default/fleet-server--8.4.0
S+ 10044 19443 grep elastic-agent