On Tue, Sep 14, 2004 at 11:55:18AM +0600, Dmitry A. Bondareff wrote: > Hello hackers! > > On my system which connected to Internet I''ll see many processes like (sh): > # ps axu | more > USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND > root 59548 1,0 0,0 0 0 ?? Z 11:00 0:00,00 (sh) > root 59588 0,0 0,0 0 0 ?? Z 11:02 0:00,00 (sh) > root 185 0,0 0,0 0 0 ?? Z 2июл04 0:00,00 (sh) > > WHAT IS IT ??
According to the ps(1) manual page, the 'Z' flag means that the process is what is commonly known as 'zombie' - a process that has ended its execution, either exiting voluntarily or killed by a signal, and is being kept in memory until its parent process collects whatever information is necessary. The fact that you are seeing those zombie processes may mean one of two things: either the 'sh' processes have ended really, really recently and their parent has not yet had a chance to invoke one of the functions described in the wait(2) manual page to collect the information, or the 'sh' processes have terminated some time ago but their parent is busy doing something else, possibly locked up or something. You may gather a lot more information by including the parent process ID in the 'ps' output: try 'ps axl' or 'ps axlwww', see what has invoked all those 'sh' processes, see if it has left any logs as to why, what happened, and so on. G'luck, Peter -- Peter Pentchev [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 I've heard that this sentence is a rumor.
pgprYo7VhLM6q.pgp
Description: PGP signature