What does it mean

[Peter Pentchev]

On Tue, Sep 14, 2004 at 11:55:18AM +0600, Dmitry A. Bondareff wrote:
> Hello hackers!
> 
> On my system which connected to Internet I''ll see many processes like (sh):
> # ps axu | more
> USER    PID %CPU %MEM   VSZ  RSS  TT  STAT STARTED      TIME COMMAND
> root  59548  1,0  0,0     0    0  ??  Z    11:00     0:00,00  (sh)
> root  59588  0,0  0,0     0    0  ??  Z    11:02     0:00,00  (sh)
> root    185  0,0  0,0     0    0  ??  Z     2июл04   0:00,00  (sh)
> 
> WHAT IS IT ??

According to the ps(1) manual page, the 'Z' flag means that the process
is what is commonly known as 'zombie' - a process that has ended its
execution, either exiting voluntarily or killed by a signal, and is
being kept in memory until its parent process collects whatever
information is necessary.  The fact that you are seeing those zombie
processes may mean one of two things: either the 'sh' processes have
ended really, really recently and their parent has not yet had a chance
to invoke one of the functions described in the wait(2) manual page to
collect the information, or the 'sh' processes have terminated some time
ago but their parent is busy doing something else, possibly locked up or
something.

You may gather a lot more information by including the parent process ID
in the 'ps' output: try 'ps axl' or 'ps axlwww', see what has invoked
all those 'sh' processes, see if it has left any logs as to why, what
happened, and so on.

G'luck,
Peter

-- 
Peter Pentchev	roam at ringlet.net    roam at cnsys.bg    roam at FreeBSD.org
PGP key:	http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint	FDBA FD79 C26F 3C51 C95E  DF9E ED18 B68D 1619 4553
I've heard that this sentence is a rumor.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-hackers/attachments/20040914/5fdc19bb/attachment.bin