I have a few Ubuntu Server 14.04.03 LTS boxes that will occasionally spawn hundreds of zombie sh processes. This process spike will be picked up by the monitoring system, and send an alert. I found out that the process spike was sh zombie procs by running top -b -d 15 -n 150 >> top-file, then searching the top-file for any top snapshots that show this spike. Is there a better way of capturing this information? I would like to be able to see the parent process and figure out why this is happening.