Results 1 to 3 of 3

Thread: defunct ?

  1. #1
    Join Date
    Mar 2003
    Posts
    345

    Question defunct ?

    Anyone know how to find the thing/app/script behind this "sh <defunct>" ?

    Code:
    679 root       9   0   592  592   536 S     0.0  0.0   0:00   0 crond
    680 root       8   0     0    0     0 Z     0.0  0.0   0:00   0 sh <defunct>
    What is that ?

    "lsof" does not catch it :

    Code:
    crond       679   root  cwd    DIR        3,2     4096    344065 /var/spool
    crond       679   root  rtd    DIR        3,6     4096         2 /
    crond       679   root  txt    REG        3,3    23228    131643 /usr/sbin/crond
    crond       679   root  mem    REG        3,6   106400     58533 /lib/ld-2.3.2.so
    crond       679   root  mem    REG        3,6  1552740     58512 /lib/i686/libc-2.3.2.so
    crond       679   root  mem    REG        3,6    52492     66226 /lib/libnss_files-2.3.2.so
    crond       679   root    0u   CHR        5,1              58719 /dev/console
    crond       679   root    1w  FIFO        0,5               1137 pipe
    crond       679   root    2w  FIFO        0,5               1138 pipe
    crond       679   root    4u  unix 0xf777d080               1142 socket
    crond       679   root    6r  FIFO        0,5               1410 pipe
    httpd       691   root  cwd    DIR        3,6     4096         2 /
    httpd       691   root  rtd    DIR        3,6     4096         2 /
    There is no other user in this server, except me.

    Redhat 9.0.

    Thanks for any advice,.
    Last edited by kapot; 10-03-2006 at 04:36 PM.

  2. #2
    Join Date
    Dec 2005
    Posts
    82
    unfortunately you won't able to find how this process was ran. Here is a short description
    for defunct process:

    "Defunct — One that has terminated (either because it has been killed
    by a signal or because it has called exit()) and whose parent process has not yet received
    notification of its termination by executing (some form of) the wait() system call"

    Also it is called "zombie" process. As you understand it is already terminated process,
    it doesn't consume any resources but still exists in kernel table list
    of processes.

  3. #3
    edited : beaten to the post! This post can be deleted.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •