Zombies

[pete at pwdk.com]

Glenn Steen wrote:
> On 02/01/07, pete at pwdk.com <pete at pwdk.com> wrote:
>> Hi
>>
>> Happy New Year :-)
>>
>> I've just been looking at my process list and noticed quite a few
>> Zombies, 15 in total, 8 MailScann and 7 sh, the email system seems to be
>> working correctly as far as I can tell, so I'm not sure why I'm getting
>> these Zombies.
> 
> Q: What is a Zombie?
> A: A dead-process-placeholder, preventing (child) process ID reuse
> before the parent process has either noticed it being dead (by a wait
> call), or the parent being terminated itself.
> 
> A simple google (just google for "zombie processes") will give you
> several excellent explanations to this effect.
> A zombie takes no real system resources, nor "interracts" with teh
> system in any noticable way, apart from taking up a slot in the
> process list...
> 
>> Top output :-
>>
>> 2202 mailnull  20   0     0    0    0 Z    0  0.0   0:00.14 MailScann
>> 21103 nobody    23   0     0    0    0 Z    0  0.0   0:00.00 sh
>>
>>
>> Are these normal?
> Definitely, you have zobies all the time. If they "stick around", they
> _may_ be an indication of a problem, but more likely not.
> In this particular case, you can likely deduce that these are MS
> "helpers" that run things like AV scanners etc, and they should go
> away relatively swiftly (to be replaced with new ones). It depends a
> bit on what is happening, and the relative speed of your system etc.
> Look at your maillog, if you see SpamAssassin timeouts etc... then you
> really do have a problem to work with. But then the zombbies "sticking
> around" is just an indicator, not a real problem in and off itself.
> 
>> Should I be worried about them?
> Not really, no.
> 
>> Can anything be done about them?
> If you know which parent process (use ps;-), you _could_ kill that ...
> but that is _not_ recommended. As said, they should clear up by
> themselves (or rather by way of the parent:-).
> 
>> Am I loosing emails?
> Not due to that, no.
> But do check your logs carefully... If the zombies are due to
> extremely slow I/O (broken disk, network problem, whatever) you could
> be losing mails due to that specific fault;).
> 
>>
>> I'm running CentOS 4.4 with cPanel, and used the MailScanner Service
>> supplied by configserver.com
> There are a few on this list who do (I don't), so maybe they'll jump
> in with some pertinent advice:)
> 
> Cheers




*************************************
 >> Are these normal?
 > Definitely, you have zobies all the time. If they "stick around", they
 > _may_ be an indication of a problem, but more likely not.
 > In this particular case, you can likely deduce that these are MS
 > "helpers" that run things like AV scanners etc, and they should go
 > away relatively swiftly (to be replaced with new ones). It depends a
 > bit on what is happening, and the relative speed of your system etc.
 > Look at your maillog, if you see SpamAssassin timeouts etc... then you
 > really do have a problem to work with. But then the zombies "sticking
 > around" is just an indicator, not a real problem in and off itself.
*************************************


I've searched the maillog and these are the only error messages I've found.


There are several messages like this
**********************
Jan  2 05:00:07 woody MailScanner[3790]: MailScanner child caught a SIGHUP
**********************

At one minute past the hour messages like this

**********************
Jan  2 05:01:01 woody ClamAV-autoupdate[7595]: ClamAV update warning: 
ERROR: Problem with internal logger.

Jan  2 05:01:01 woody ClamAV-autoupdate[7595]: ClamAV update warning: 
ERROR: Can't open /tmp/ClamAV.update.log in append mode (check 
permissions!).

Jan  2 05:01:01 woody ClamAV-autoupdate[7595]: ClamAV updater failed
**********************


I then set the permissions on /tmp/ClamAV.update.log and waited to see 
what happened when the next ClamAv update occurred. Straight after the 
update I saw the following messages repeated several times.

*************************
MailScanner[7156]: ClamAV update of /usr/local/share/clamav/daily.cvd 
detected, resetting ClamAV Module

MailScanner[7156]: ClamAV virus database has been updated, killing this 
child

MailScanner[7156]: Config: calling custom end function MailWatchLogging

MailScanner[7156]: MailScanner child dying of old age
*************************


This seems to have cured the MailScann zombies hanging around problem, I 
still have 5 or 6 MailScann zombies but they don't hang around too long now.


I still have 7 "sh" constant PID Zombies, but they may well be another 
possibly unrelated issue, although I'm not sure what is causing those 
and why.

Pete