process toble

roller24 · 03-30-2007, 09:04 AM

Ive always noticed that in my process table I have multiple entries for the same process.

Is this normal?

{BBI}Nexus{BBI} · 03-30-2007, 12:56 PM

Depends, some processes will spawn multiple instances. Have a look at your process table in 'tree view' that will not only show you the processes but also other processes spawned by the original process. Phew, i'm all processed out!!

MensaWater · 03-30-2007, 01:05 PM

You might want to give an example.

Sometimes what you're actually seeing are multiple "threads" of a single "process". These are called "clone processes". It has to do with the way Linux does NPTL (Native POSIX Thread Library). It is different than the way you see it on UNIX variants.

There were some kernel releases that didn't show the threads automatically even though they were there. By specifying an option with ps (-m) you could force them to display but the default now is that they do display. We had a slightly older 2.4 kernel on one server that I needed the -m to display but on the slightly newer 2.4 kernel on its mate I didn't need the -m.

You can confirm they are clone processes by verifying the memory for them is exactly the same.

Notes from something I did when investigating this on those two systems some time back. The processes I was interested in were named "omaws32". You would want to substitute the name you're interested in:

Quote:

First run a loop to dump the memory map of all the processes:

mkdir /tmp/omaws32
for PROC in `ps -ef |grep omaws32 |grep -v grep |awk '{print $2}'`
do cat /proc/${PROC}/maps >/tmp/omaws32/${PROC}.out
done

Then determine which one is the parent of all the others. Also then pick a single child to be your test case. In my situation 15862 was the parent and 15863 was the first child. I therefore did:

cd /tmp/omaws32
for FILE in `ls |egrep -v "15862|15863"`
do
echo $FILE
diff $FILE 15863.out
done |more

The above script gave a list of all the memory map files created by the first loop excluding the parent and the first child. It then did a diff of each of the remaining files (the other children) against the first child’s map file. Since the only output was the file name (echo $FILE) it proved that all the files were exactly the same meaning each of the children (including the first one) had exactly the same memory map and therefore were in fact using the same memory space.

An additional test would be to run cksum against each of the children map files to verify the sums seen are the same for each (they were here).

Don’t forget to rm –rf /tmp/omaws32 when done.

roller24 · 04-03-2007, 09:20 AM

Thanks guys, I appreciate the clarification

MensaWater · 04-03-2007, 11:14 AM

Quote:

<--- Very Insecure System Try Another --->

Funny.

How about:
V ague
I nternet
S ecurity
T oasts
A pplications