On 2/27/07, Eric Shubes <plug@shubes.net> wrote:
I've just stumbled upon something I *really* don't understand.
I'm helping a guy in Finland troubleshoot a problem with his qmail-toaster.
While receiving an email, there is a clamd process that eats the cpu
(apparently looping).
Here's the process tree:
---tcpserver(20201)-+-qmail-smtpd(22487)---simscan(22489)---clamdscan(22491)
`-qmail-smtpd(24172)---simscan(24174)---clamdscan(24176)
This appears to be normal. However, 'top' shows two looping processes:
PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
24177 clamav 25 0 25020 21M 1532 R 47.9 2.1
11:03 1 clamd
22492 clamav 25 0 25020 21M 1532 R 45.3 2.1 20:54 1 clamd
I'm wondering, where'd these processes come from? When we do a
"ps -ef | grep clam" they don't show up. They don't show up with
"ps -p 24177" either.
There is a clamd daemon running, but it's PID is 21988.
Just in case you're wondering, I don't yet understand exactly how these
pieces (are supposed to) all fit together.
How can these processes exist, yet ps not see them?
I'm ready for an education now.
--
-Eric 'shubes'
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
Is 21988 the parent for 24177 and/or 22492? While top is running type f to toggle a field for display, then b to select the parent PID followed by any key to return to the top display. I also wonder if it has something to do with threading but that's a wild hair. You could also turn on the display of flags (explained on the field select page) to see if that shows any uniqueness for the clamav processes. Dunno what this is but maybe a clue or two for you.
--
Be who you are and say what you feel, because those who mind don't matter and those who matter don't mind. - Dr. Seuss