From owner-freebsd-hackers@FreeBSD.ORG Tue Sep 14 12:30:29 2004 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 908B216A4D3 for ; Tue, 14 Sep 2004 12:30:29 +0000 (GMT) Received: from gandalf.online.bg (gandalf.online.bg [217.75.128.9]) by mx1.FreeBSD.org (Postfix) with SMTP id 27FFE43D31 for ; Tue, 14 Sep 2004 12:30:23 +0000 (GMT) (envelope-from roam@ringlet.net) Received: (qmail 9646 invoked from network); 14 Sep 2004 12:27:55 -0000 Received: from unknown (HELO straylight.m.ringlet.net) (217.75.134.254) by gandalf.online.bg with SMTP; 14 Sep 2004 12:27:55 -0000 Received: (qmail 1999 invoked by uid 1000); 14 Sep 2004 12:30:53 -0000 Date: Tue, 14 Sep 2004 15:30:53 +0300 From: Peter Pentchev To: "Dmitry A. Bondareff" Message-ID: <20040914123052.GA965@straylight.m.ringlet.net> Mail-Followup-To: "Dmitry A. Bondareff" , freebsd-hackers@freebsd.org References: <018e01c49a1f$6a4c1050$02010101@dimasic> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="r5Pyd7+fXNt84Ff3" Content-Disposition: inline In-Reply-To: <018e01c49a1f$6a4c1050$02010101@dimasic> User-Agent: Mutt/1.5.6i cc: freebsd-hackers@freebsd.org Subject: Re: What does it mean X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Sep 2004 12:30:29 -0000 --r5Pyd7+fXNt84Ff3 Content-Type: text/plain; charset=windows-1251 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Sep 14, 2004 at 11:55:18AM +0600, Dmitry A. Bondareff wrote: > Hello hackers! >=20 > On my system which connected to Internet I''ll see many processes like (s= h): > # ps axu | more > USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND > root 59548 1,0 0,0 0 0 ?? Z 11:00 0:00,00 (sh) > root 59588 0,0 0,0 0 0 ?? Z 11:02 0:00,00 (sh) > root 185 0,0 0,0 0 0 ?? Z 2=E8=FE=EB04 0:00,00 (sh) >=20 > WHAT IS IT ?? According to the ps(1) manual page, the 'Z' flag means that the process is what is commonly known as 'zombie' - a process that has ended its execution, either exiting voluntarily or killed by a signal, and is being kept in memory until its parent process collects whatever information is necessary. The fact that you are seeing those zombie processes may mean one of two things: either the 'sh' processes have ended really, really recently and their parent has not yet had a chance to invoke one of the functions described in the wait(2) manual page to collect the information, or the 'sh' processes have terminated some time ago but their parent is busy doing something else, possibly locked up or something. You may gather a lot more information by including the parent process ID in the 'ps' output: try 'ps axl' or 'ps axlwww', see what has invoked all those 'sh' processes, see if it has left any logs as to why, what happened, and so on. G'luck, Peter --=20 Peter Pentchev roam@ringlet.net roam@cnsys.bg roam@FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 I've heard that this sentence is a rumor. --r5Pyd7+fXNt84Ff3 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (FreeBSD) iD8DBQFBRuR87Ri2jRYZRVMRAo0SAJ9UIJx6MfiXrrqQQ8G2MsS7LyQZGwCcDDBD t2POPZKyq9xLwW8+6daMqFE= =Waqy -----END PGP SIGNATURE----- --r5Pyd7+fXNt84Ff3--