Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 20 Mar 2014 10:58:38 -0400
From:      John Baldwin <jhb@freebsd.org>
To:        freebsd-stable@freebsd.org
Cc:        Marcelo Gondim <gondim@bsdinfo.com.br>
Subject:   Re: sshd with zombie process on FreeBSD 10.0-STABLE - workaround
Message-ID:  <201403201058.38555.jhb@freebsd.org>
In-Reply-To: <5329D81E.7040709@bsdinfo.com.br>
References:  <53016D97.5030909@bsdinfo.com.br> <CAN6yY1uucfkdXxkCF30w1Q9vffRpDLxM90Sz1XVbdn5W69vQMg@mail.gmail.com> <5329D81E.7040709@bsdinfo.com.br>

next in thread | previous in thread | raw e-mail | index | archive | help
On Wednesday, March 19, 2014 1:47:10 pm Marcelo Gondim wrote:
> Em 19/03/14 13:01, Kevin Oberman escreveu:
> > On Wed, Mar 19, 2014 at 6:00 AM, Marcelo Gondim 
<gondim@bsdinfo.com.br>wrote:
> >
> >> Hi all,
> >>
> >> While the solution does not appear, did the script below and put it in
> >> crontab to automatically delete zombie sshd processes.
> >>
> >> the_walking_dead.sh:
> >>
> >> #!/bin/sh
> >> kill -9 `ps afx|grep sshd|grep unknown|awk '{print $1}'`
> >>
> >>
> >> Put this in /etc/crontab:
> >>
> >> 00 1 * * *    root    the_walking_dead.sh
> >>
> >>
> > If 'kill -9' works, the process is not really a zombie. It simply still 
has
> > a socket open and is waiting for it to be closed before exiting.
> >
> > You might takes a look at network sockets with sockstat(1) and see if you
> > can get any indication of why these sockets are not being closed. It may 
be
> > that the issue is not sshd but some other issue in the OS leaving sockets
> > open.
> >
> Hi Kevin,
> 
> My ps -afx below:
> 
> [...]
> 42139  -  Is       0:00.01 sshd: unknown [priv] (sshd)
> 42140  -  Z        0:00.01 <defunct>
> 42141  -  IW       0:00.00 sshd: unknown [pam] (sshd)
> 58445  -  Is       0:00.01 sshd: unknown [priv] (sshd)
> 58446  -  Z        0:00.02 <defunct>
> 58447  -  IW       0:00.00 sshd: unknown [pam] (sshd)
> 65635  -  Is       0:00.01 sshd: vinicius [priv] (sshd)
> 65636  -  Z        0:00.01 <defunct>
> [...]
> 
> # sockstat | grep 42140
> #
> 
> # sockstat | grep 58446
> #
> 
> # sockstat | grep 65636
> #
> 
> No associated socket with zombie process.

Do a pstree.  I bet the zombies are children of the other processes that
are stuck on a socket as Kevin described.

-- 
John Baldwin



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201403201058.38555.jhb>