Zombies

Glenn Steen glenn.steen at gmail.com
Wed Jan 3 11:56:25 CET 2007


On 02/01/07, pete at pwdk.com <pete at pwdk.com> wrote:
>
>
> Glenn Steen wrote:
(snippety-snip)
>
> *************************************
>  >> Are these normal?
>  > Definitely, you have zobies all the time. If they "stick around", they
>  > _may_ be an indication of a problem, but more likely not.
>  > In this particular case, you can likely deduce that these are MS
>  > "helpers" that run things like AV scanners etc, and they should go
>  > away relatively swiftly (to be replaced with new ones). It depends a
>  > bit on what is happening, and the relative speed of your system etc.
>  > Look at your maillog, if you see SpamAssassin timeouts etc... then you
>  > really do have a problem to work with. But then the zombies "sticking
>  > around" is just an indicator, not a real problem in and off itself.
> *************************************
>
>
> I've searched the maillog and these are the only error messages I've found.
>
>
> There are several messages like this
> **********************
> Jan  2 05:00:07 woody MailScanner[3790]: MailScanner child caught a SIGHUP
> **********************
>
> At one minute past the hour messages like this
>
> **********************
> Jan  2 05:01:01 woody ClamAV-autoupdate[7595]: ClamAV update warning:
> ERROR: Problem with internal logger.
>
> Jan  2 05:01:01 woody ClamAV-autoupdate[7595]: ClamAV update warning:
> ERROR: Can't open /tmp/ClamAV.update.log in append mode (check
> permissions!).
>
> Jan  2 05:01:01 woody ClamAV-autoupdate[7595]: ClamAV updater failed
> **********************
>
>
> I then set the permissions on /tmp/ClamAV.update.log and waited to see
> what happened when the next ClamAv update occurred. Straight after the
> update I saw the following messages repeated several times.
>
> *************************
> MailScanner[7156]: ClamAV update of /usr/local/share/clamav/daily.cvd
> detected, resetting ClamAV Module
>
> MailScanner[7156]: ClamAV virus database has been updated, killing this
> child
>
> MailScanner[7156]: Config: calling custom end function MailWatchLogging
>
> MailScanner[7156]: MailScanner child dying of old age
> *************************
>
>
> This seems to have cured the MailScann zombies hanging around problem, I
> still have 5 or 6 MailScann zombies but they don't hang around too long now.

Excellent, so there really was a problem that was rather easy to find
and fix:-). Good.

> I still have 7 "sh" constant PID Zombies, but they may well be another
> possibly unrelated issue, although I'm not sure what is causing those
> and why.
>
> Pete

What is the parent process of these? Is it the same PIDs all the time,
or are they different over a few minutes? Can be a starting point at
least...
As I'm sure you've read up on this, you know by now that both flakey
HW and drivers can cause excessive zombies to "stick around" virtually
forever, so don't limit yourself only to the maillog... Look through
syslog and/or messages too.
And if HW/drivers are the "root cause", then you might need reboot to
clear them. Not that you really likely _need_ clear them, you can
probably just rest assured that the next scheduled reboot will make
them go away (if they really are "stuck forever").

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se


More information about the MailScanner mailing list