Re: "phantom" processes?

On 2/27/07, Eric Shubes <plug@shubes.net> wrote:
>
> I've just stumbled upon something I *really* don't understand.
>
> I'm helping a guy in Finland troubleshoot a problem with his
> qmail-toaster.
> While receiving an email, there is a clamd process that eats the cpu
> (apparently looping).
>
> Here's the process tree:
>
> ---tcpserver(20201)-+-qmail-smtpd(22487)---simscan(22489)---clamdscan(22491)
>

>                     `-qmail-smtpd(24172)---simscan(24174)---clamdscan(24176)

>

> This appears to be normal. However, 'top' shows two looping processes:
>   PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME CPU COMMAND
> 24177 clamav    25   0 25020  21M  1532 R    47.9  2.1  11:03   1 clamd
> 22492 clamav    25   0 25020  21M  1532 R    45.3  2.1  20:54   1 clamd

>
> I'm wondering, where'd these processes come from? When we do a
> "ps -ef | grep clam" they don't show up. They don't show up with
> "ps -p 24177" either.
>
> There is a clamd daemon running, but it's PID is 21988.
>
> Just in case you're wondering, I don't yet understand exactly how these
> pieces (are supposed to) all fit together.
>
> How can these processes exist, yet ps not see them?
> I'm ready for an education now.
>
> --
> -Eric 'shubes'
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>

Is 21988 the parent for 24177 and/or 22492? While top is running type f to
toggle a field for display, then b to select the parent PID followed by any
key to return to the top display. I also wonder if it has something to do
with threading but that's a wild hair. You could also turn on the display
of flags (explained on the field select page) to see if that shows any
uniqueness for the clamav processes. Dunno what this is but maybe a clue or
two for you.


--
Be who you are and say what you feel, because those who mind don't matter
and those who matter don't mind. - Dr. Seuss
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss