Hi and thanks for reading.
I have a linux proxy with Slackware 13.0 kernel 2.6.29.6-smp, OpenSSH_5.2p1, OpenSSL 0.9.8k 25 Mar 2009.
When i connect from putty or another terminal via ssh(it doesn't matter) and close the session (with logout or exit command), automatically a zombie process appears. The strange thing is that i have another server with very different harwdware but the same OS and software and it doesn't have this problem.

This is what i see:

root@host:~# ps fax | grep Z | grep -v grep
5037 ? Z 0:00 | \_ [sshd] <defunct>
8181 ? Z 0:00 | \_ [sshd] <defunct>
8651 ? Z 0:00 | \_ [sshd] <defunct>
9358 ? Z 0:00 | \_ [sshd] <defunct>
9469 ? Z 0:00 | \_ [sshd] <defunct>
10074 ? Z 0:00 | \_ [sshd] <defunct>
10519 ? Z 0:00 \_ [sshd] <defunct>

Feel free to ask me for any information.
Thanks!

Hi ttitoo96.

Welcome to LQ!

You can kill the zombies if it makes you feel better. One thing you can try is deleting everything in /tmp and rebooting. I'm not exactly sure why that works, but it does.

obviously it is a configuration issue, most probably the sshd config is not ok

If it is configuration issue it is quite common.

Thank you all for your replies.
My /etc/ssh/ssh_config file is by default. No changes has been made.
Here is my /etc/ssh/sshd_config file

root@surfer:/etc/ssh# grep -v "^#" sshd_config | grep .
Port 32460
Protocol 2
PermitRootLogin no
PermitEmptyPasswords no
Subsystem sftp /usr/libexec/sftp-server

AFAIR there was such a problem with openssh 5.2.
Might also be a problem with udev or with a "network manager", see this bug.

I've read the whole post. I am not an expert, but from reading about this bug i understood that was a problem with the "Sigmask". So i checked that:

cat /proc/`pidof sshd| awk '{print $1}'`/status | grep Sig
SigQ: 0/26543
SigPnd: 0000000000000000
SigBlk: 0000000000000000 # This is right
SigIgn: 0000000000001000
SigCgt: 0000000000010000

I don't think my problem is related to this bug.
Is there something else that i can test?
Thanks so much.

who is the parent?
do you have anything in ~/.bash_logout (or something similar?)

Do the defunct processes have child processes?
Using the attached ptree script you can do

Attached Files

ptree.txt (792 Bytes, 18 views)

The defunct processes does not have child processes.