Quoting [EMAIL PROTECTED] <[EMAIL PROTECTED]>: > Hi, > > 3 days after starting my potato system lpd started to run. > system started Feb 6 > ps output: > USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND > root 6833 0.0 1.3 1052 412 ? S Feb09 0:00 /usr/sbin/lpd > root 6836 0.0 1.5 1076 468 ? S Feb09 0:00 /usr/sbin/lpd > or > root 6833 0.0 1.3 1052 412 ? S Feb09 0:00 /usr/sbin/lpd > root 6836 0.0 1.5 1076 468 ? S Feb09 0:00 \_ /usr/sbin/lpd
Notice the little slash widget here ^ This indicates that the second instance was forked by the first (i.e., it is a child of the first). Also the PIDs are very close, indicating that they probably were started at about the same time. A number of daemons will fork, persisently fork, or pre-fork to allow multiple simultaneous connections. This is generally more robust (read easier to get right) than handling multiple connections in one process. The PID is not particularly low (less than 1-2 thousand). This fits in with your statement that lpd was not started at boot. This all looks very normal. Not to guarantee that your box has not been cracked, but this isn't evidence of it. Jeffrey -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]