Re: [semi-OT]: finding process which is defunct

On Wed, Mar 24, 2004 at 07:35:37PM +0000, Payal Rathod wrote:
> Hi,
> Just looking at ps waux I found a process which was defunct. How do I
> know which program is being run?
> 
> The ps output show,
> root      3033  0.0  0.0     0    0 ?        Z    00:55   0:00
> [tcpserver] <defunct>
> 
> Also, the pid keeps on changing.
> 
> Can someone help on this?

Dunno which OS you're running.  On mine (FreeBSD), the headers for
your ps command would show up like this:

  USER   PID   %CPU %MEM   VSZ  RSS  TT  STAT STARTED      TIME COMMAND
  root   3033  0.0  0.0     0    0    ?   Z   00:55        0:00 [tcpserver] <defunct>

Try 'pw auxwwe', this will show you the environment of the process
as well.

Clue #1:

  Who owns your tcpserver processes?  On my mail server, qmail-pop3d
  is _not_ run setuid, so it's owned by root.  Contrast that with
  qmail-smtpd, which is run with uid qmaild.

Clue #2:

  Your process is a zombie process:

  <http://wombat.doc.ic.ac.uk/foldoc/foldoc.cgi?zombie+process>

  I _think_ in your case, this may mean you have a run script that
  doesn't do it's thing using exec.

  Compare:

    exec /usr/local/bin/tcpserver ... smtp /var/qmail/bin/qmail-smtpd 2>&1

  with:

    /usr/local/bin/tcpserver ... smtp /var/qmail/bin/qmail-smtpd 2>&1

  See if any of your invokations of tcpserver look different from
  the others.

Explore the '-o' option to ps, ferret out info about parent processes,
process groups, and so forth.

Good luck...

> With warm regards,
> -Payal

-- 
Brian Reichert				<[email protected]>
37 Crystal Ave. #303			Daytime number: (603) 434-6842
Derry NH 03038-1713 USA			BSD admin/developer at large