Strange process

Kris Kennaway kris at obsecurity.org
Wed Feb 15 14:54:24 PST 2006


On Wed, Feb 15, 2006 at 04:34:32PM -0600, Dan Nelson wrote:
> In the last episode (Feb 15), Kris Kennaway said:
> > On Wed, Feb 15, 2006 at 01:42:04PM -0600, Dan Nelson wrote:
> > > In the last episode (Feb 15), Ivan Kolosovskiy said:
> > > > top:
> > > > PID USERNAME  THR PRI NICE   SIZE    RES STATE  C   TIME   WCPU COMMAND
> > > > 38410 findfile    1  96    0     0K     0K START  0   0:00  0.00% grotty
> > > > 
> > > > ps:
> > > > host$ ps -waux | grep grotty
> > > > findfile 38410  0,0  0,0     0     0  p6  REJ  19:57     0:00,25 [grotty]
> > > 
> > > E in the STAT column means the process is trying to exit, but
> > > can't. What does "ps lp 38410" print?  The MWCHAN column should say
> > > where in the kernel the process is stuck.
> > 
> > I often see this too.  For example:
> > 
> >   PID USERNAME    THR PRI NICE   SIZE    RES STATE    TIME   WCPU COMMAND
> >  5357 kkenn         1  96    0     0K     0K START    0:00  0.35% xpdf
> > 
> > > ps -waux  | grep xpdf
> > kkenn    5357  0.3  0.0     0     0  ??  RE   Sun08PM   0:00.20 [xpdf]
> > 
> > > ps lp 5357
> >   UID   PID  PPID CPU PRI NI   VSZ   RSS MWCHAN STAT  TT       TIME COMMAND
> 
> That syntax should have worked...  Try a plain "px axl | grep xpdf"
> instead.

You're not mistaken, it's just not there.

> ps axl | grep xpdf
 1000  5357 78788   2  96  0     0     0 -      RE    ??    0:00.20 [xpdf]

> ps -p 5357
  PID  TT  STAT      TIME COMMAND

Kris

> I think top's START state corresponds to the ~200-line window of code
> in kern_fork.c:fork1() between p_state=PRS_NEW and p_state=PRS_NORMAL,
> but I'm not positive.
> 
> -- 
> 	Dan Nelson
> 	dnelson at allantgroup.com
> _______________________________________________
> freebsd-stable at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to "freebsd-stable-unsubscribe at freebsd.org"
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20060215/222fac31/attachment.bin


More information about the freebsd-stable mailing list