Date: Tue, 14 Sep 2004 15:30:53 +0300 From: Peter Pentchev <roam@ringlet.net> To: "Dmitry A. Bondareff" <dmitry@mmk.ru> Cc: freebsd-hackers@freebsd.org Subject: Re: What does it mean Message-ID: <20040914123052.GA965@straylight.m.ringlet.net> In-Reply-To: <018e01c49a1f$6a4c1050$02010101@dimasic> References: <018e01c49a1f$6a4c1050$02010101@dimasic>
next in thread | previous in thread | raw e-mail | index | archive | help
--r5Pyd7+fXNt84Ff3 Content-Type: text/plain; charset=windows-1251 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Sep 14, 2004 at 11:55:18AM +0600, Dmitry A. Bondareff wrote: > Hello hackers! >=20 > On my system which connected to Internet I''ll see many processes like (s= h): > # ps axu | more > USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND > root 59548 1,0 0,0 0 0 ?? Z 11:00 0:00,00 (sh) > root 59588 0,0 0,0 0 0 ?? Z 11:02 0:00,00 (sh) > root 185 0,0 0,0 0 0 ?? Z 2=E8=FE=EB04 0:00,00 (sh) >=20 > WHAT IS IT ?? According to the ps(1) manual page, the 'Z' flag means that the process is what is commonly known as 'zombie' - a process that has ended its execution, either exiting voluntarily or killed by a signal, and is being kept in memory until its parent process collects whatever information is necessary. The fact that you are seeing those zombie processes may mean one of two things: either the 'sh' processes have ended really, really recently and their parent has not yet had a chance to invoke one of the functions described in the wait(2) manual page to collect the information, or the 'sh' processes have terminated some time ago but their parent is busy doing something else, possibly locked up or something. You may gather a lot more information by including the parent process ID in the 'ps' output: try 'ps axl' or 'ps axlwww', see what has invoked all those 'sh' processes, see if it has left any logs as to why, what happened, and so on. G'luck, Peter --=20 Peter Pentchev roam@ringlet.net roam@cnsys.bg roam@FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 I've heard that this sentence is a rumor. --r5Pyd7+fXNt84Ff3 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (FreeBSD) iD8DBQFBRuR87Ri2jRYZRVMRAo0SAJ9UIJx6MfiXrrqQQ8G2MsS7LyQZGwCcDDBD t2POPZKyq9xLwW8+6daMqFE= =Waqy -----END PGP SIGNATURE----- --r5Pyd7+fXNt84Ff3--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040914123052.GA965>