Please have you a script to find zombie processes

[baruch]

thread52-1108457

I found a ZOMBIE for a user called "sofri".

I could not find this user, by the command "who", but with ps -ef | grep sofri, I found a proccess belong to "sofri" with too much STIME and in TTY column just "-".

   sofri 29012 29978   0   Oct 02      -  0:00 /usr/bin/sh /abic0/bin/ex vmecrid -s 000100
   sofri 29978     1   0   Oct 02      -  0:00 sh /abic0/proc/e-vmecridr
   sofri 32202 29012  78   Oct 02      - 11205:27 /abic0/bin/rmc/runcobol vmecrid -s 000100

How can i have a script to find such cases?.

 

[khalidaaa]

Have a look at this:

http://www.tek-tips.com/viewthread.cfm?qid=1465728&page=3

Another way of doing it is to look at the STAT column in ps aux output

STAT column 
R means RUNNING process 
S means SLEEPING process 
Z means ZOMBIE process

http://www.ahinc.com/aix/perform.htm#ps

To find Zombie processes, you can do this:

ps aux | grep " Z "

If you want an accurate result, you can use awk instead of grep! But grep will usually do the job!

Regards,
Khalid

 

[khalidaaa]

I'm not that good in awk so that's what i managed to get:

ps aux | awk '( $8 == "Z" ) {print}'

Regards,
Khalid

 

[p5wizard]

> I found a [red]ZOMBIE[/red] for a user called "sofri".

No you didn't ;-) ... You found a runaway process. One that was left after a user's session was terminated in an abrupt way. Mostly it is runaway because it is trying to read from its standard input, which points to a device that no longer exists... So it just loops on read() system calls that error out because the read() call fails each time.

A process like that can be hard to spot... Just because the TTY column is "-" doesn't mean it's a runaway process, you may have legitimate background processes like that. And with [tt]ps -ef[/tt] as well as [tt]ps aux[/tt], the time column is either in the format "hh:mm:ss" or "Mon dd", so I'd prime the ps output first with sed:

[tt]ps -ef|sed 's/\( [ADFJMNOS][acenpu][bcglnprtvy]\) /\1/'[/tt]

Next you want to see if the TTY field is "-" and the TIME is field is very big...

[tt]ps -ef|sed 's/\( [ADFJMONS][acenpu][bcglnprtvy]\) /\1/'|awk '{
if ($6=="-") {
split($7,tm,":");
if (tm[1]*60+tm[2] > 50000)
print
}
}'[/tt]

But you may want to limit to non-root processes:

[tt]ps -ef|sed 's/\( [ADFJMONS][acenpu][bcglnprtvy]\) /\1/'|awk '{
if ($1!="root" && $6=="-") {
split($7,tm,":");
if (tm[1]*60+tm[2] > 50000)
print
}
}'[/tt]

And to include the ps header line:

[tt]ps -ef|sed 's/\( [ADFJMONS][acenpu][bcglnprtvy]\) /\1/'|awk '{
if (NR==1) {
header=$0
printed=0
}
if ($1!="root" && $6=="-") {
split($7,tm,":");
if (tm[1]*60+tm[2] > 50000) {
if (printed==0) {
print header
printed=1
}
print
}
}
}'[/tt]


HTH,

p5wizard