Rastream call script zombie

Peter Van Epp vanepp at sfu.ca
Sat Dec 12 23:18:18 EST 2009

	I think it has to be something like that. I've moved one of my machines
(the remote one) from 32 bit Centos to 64 bit Centos (on AMD) and run it all
night with no zombies apparant. In theory this should be identical to Matt's
RHEL 64 machine but it isn't doing the same thing (but it also isn't anywhere
near as busy either). I tried backgrounding the rastream (I was running it from
a terminal session) and even logged out to disassociate the task from a 
terminal but still no zombies. Looking back at one of Matt's posts I see he
seems to be writing out to a pipe unless the ps listing is truncated (I have 
a -w to a file as does his original command line), I wonder if that makes the 

>root      1716 31417  8 10:46 pts/1    00:00:10 rastream -S localhost:561 -M
time 1m -B 10s -f /opt/IDS/argus/etc/rastream-orig.sh -
>root      2057  1716  0 10:47 pts/1    00:00:00 [rastream-orig.s] <defunct>

	The defunct pids don't seem to be near a boundary (although 
the original parent is close enough if we have a signed/unsigned type problem)

Peter Van Epp
On Sat, Dec 12, 2009 at 10:51:30AM -0500, Carter Bullard wrote:
> If it does have problems on some 64-bit machines, is it possible
> that the pid that we use in the waitpid() call is not cast correctly,
> or is the wrong size?   I'm not near the code, and I don't really think
> this is the issue, as its running fine on lots of 64-bit machines, but
> who knows?
> Carter
> On Dec 11, 2009, at 10:38 PM, CS Lee wrote:
> > hi peter,
> > 
> > Alright i tested the script without modification again on FreeBSD 8 and Ubuntu 9.10(both 32 bits) and no problem, time to really look at 64 bits platform instead.
> > 
> > Cheers!
> > 
> > -- 
> > Best Regards,
> > 
> > CS Lee<geek00L[at]gmail.com>
> > 
> > http://geek00l.blogspot.com
> > http://defcraft.net

More information about the argus mailing list