System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

"ps -ef" displays processes running prior to last reboot

 
SOLVED
Go to solution
SkyeB
Advisor

"ps -ef" displays processes running prior to last reboot

When we rebooted our RX7640 a couple of weeks ago, we discovered that our kernel was corrupt. We were able to bring it up on a previous version of the kernel.

When we run a ps -ef we get a list of processes that started in March, even though we rebooted in September.

 

Any ideas as to what would cause such an issue?

 

'Skye

Skye Bowen
Midrange Systems Analyst III
10 REPLIES
Dennis Handly
Acclaimed Contributor

Re: "ps -ef" displays processes running prior to last reboot

>When we run a ps -ef we get a list of processes that started in March, even though we rebooted in September.

 

Hmm.  Was the date wrong and it was corrected after the system was up?

Are you on the right system?  ;-)  What does uptime show?

SkyeB
Advisor

Re: "ps -ef" displays processes running prior to last reboot

I checked root's .sh_history file, and the date has not been changed. We utilize ntp to maintain date/time synchronization

 

I have included copy/pastes of uptime, and ps -ef

 

# uptime
 12:35pm  up 16 days, 21:55,  8 users,  load average: 0.03, 0.03, 0.04

# ps -ef |more
     UID   PID  PPID  C    STIME TTY       TIME COMMAND
    root     0     0  0  Mar 26  ?         0:34 swapper
    root     1     0  0  Mar 26  ?         0:08 init
    root    13     0  0  Mar 26  ?         0:00 net_str_cached
    root    12     0  0  Mar 26  ?         0:00 usbhubd
    root    11     0  0  Mar 26  ?         0:06 escsid
    root    10     0  0  Mar 26  ?         0:00 ObjectThreadPool
    root     9     0  0  Mar 26  ?         0:00 ttisr
    root     8     0  0  Mar 26  ?         1:42 ksyncer_daemon
    root     7     0  0  Mar 26  ?         0:00 ioconfigd
    root     6     0  0  Mar 26  ?         0:06 kmemdaemon
    root     5     0  0  Mar 26  ?         0:00 signald
    root    14     0  0  Mar 26  ?         0:00 net_str_cached
    root    23     0  0  Mar 26  ?         0:00 net_str_cached
    root    22     0  0  Mar 26  ?         0:00 net_str_cached
    root    21     0  0  Mar 26  ?         0:00 net_str_cached
    root    20     0  0  Mar 26  ?         0:00 net_str_cached
    root    19     0  0  Mar 26  ?         0:00 net_str_cached
    root    18     0  0  Mar 26  ?         0:00 net_str_cached
    root    17     0  0  Mar 26  ?         0:00 net_str_cached
    root    16     0  0  Mar 26  ?         0:00 net_str_cached
    root    15     0  0  Mar 26  ?         0:00 net_str_cached
    root    24     0  0  Mar 26  ?         0:00 net_str_cached
    root    33     0  0  Mar 26  ?         0:04 lvmkd
    root    32     0  0  Mar 26  ?         0:04 lvmkd
    root    31     0  0  Mar 26  ?         0:04 lvmkd
    root    30     0  0  Mar 26  ?         0:04 lvmkd
    root    29     0  0  Mar 26  ?         0:00 kevm
    root    28     0  0  Mar 26  ?         0:00 net_str_cached
    root    27     0  0  Mar 26  ?         0:00 net_str_cached
    root    26     0  0  Mar 26  ?         0:00 net_str_cached
    root    25     0  0  Mar 26  ?         0:00 net_str_cached
    root    34     0  0  Mar 26  ?         0:04 lvmkd
    root    43     0  0  Mar 26  ?         0:00 nfs_failover
    root    42     0  0  Mar 26  ?         0:04 nfs_async_io
    root    41     0  0  Mar 26  ?         0:00 krpckd
    root    40     0  0  Mar 26  ?         0:00 nfs_reclaim
    root    39     0  0  Mar 26  ?         0:00 sendfile_vn_rele_daemon
    root    38     0  0  Mar 26  ?         0:00 side_daemon
    root    37     0  0  Mar 26  ?         0:00 usbmsd
    root    36     0  0  Mar 26  ?         0:00 lvmschedd
    root    35     0  0  Mar 26  ?         0:04 lvmkd
    root    44     0  0  Mar 26  ?         0:00 nfs4clntkd
    root    53     0  0  Mar 26  ?         0:00 lvmp_kd
    root    52     0  0  Mar 26  ?         0:00 lvmp_kd
    root    51     0  0  Mar 26  ?         0:00 lvmp_kd
    root    50     0  0  Mar 26  ?         0:00 lvmp_kd
    root    49     0  0  Mar 26  ?         0:00 lvmp_kd
    root    48     0  0  Mar 26  ?         0:00 lvmp_kd
    root    47     0  0  Mar 26  ?         0:00 cachefskd
    root    46     0  0  Mar 26  ?         0:01 autofskd
    root    45     0  0  Mar 26  ?         0:00 nfs4_async_io
    root    54     0  0  Mar 26  ?         0:00 lvmp_schedd
    root    63     0  0  Mar 26  ?         0:03 lvmdevd
    root    62     0  0  Mar 26  ?         0:00 mdep_initiator_thread
    root    61     0  0  Mar 26  ?         0:00 strfreebd
    root    60     0  0  Mar 26  ?         0:00 strweld
    root    59     0  0  Mar 26  ?         0:00 strmem
    root    58     0  0  Mar 26  ?         0:00 smpsched
    root    57     0  0  Mar 26  ?         0:00 inet_areset_daemon
    root    56     0  0  Mar 26  ?         0:00 afinet_strout
    root    55     0  0  Mar 26  ?         0:00 lvmp_wk_th_d
    root    64     0  0  Mar 26  ?         0:12 lvmattachd
    root    70     0  0  Mar 26  ?         0:25 progressdaemon

Skye Bowen
Midrange Systems Analyst III
James R. Ferguson
Acclaimed Contributor

Re: "ps -ef" displays processes running prior to last reboot

Hi:

 

Are you sure you mean 'ps' and not the output of 'who'?  If you have a corrupt '/etc/utmps' file, you may see apparent logins from "way-back".

 

Regards!

 

...JRF...

Dennis Handly
Acclaimed Contributor

Re: "ps -ef" displays processes running prior to last reboot

>I checked root's .sh_history file

 

Have you checked the various system logfiles to see any jumps in the timestamps?

SkyeB
Advisor

Re: "ps -ef" displays processes running prior to last reboot

The information is cut/paste from my putty session:

# ps -ef |more
Skye Bowen
Midrange Systems Analyst III
SkyeB
Advisor

Re: "ps -ef" displays processes running prior to last reboot

I checked the syslog.log  Any other particular logs that I should be interested in?

Skye Bowen
Midrange Systems Analyst III
Dennis Handly
Acclaimed Contributor

Re: "ps -ef" displays processes running prior to last reboot

>I checked the syslog.log  Any other particular logs that I should be interested in?

 

And what did you find?

You could also look at rc.log, cron and mail logs.

James R. Ferguson
Acclaimed Contributor

Re: "ps -ef" displays processes running prior to last reboot


SkyeB wrote:

I checked the syslog.log  Any other particular logs that I should be interested in?


Are there any 'ntp' or date/time adjustment entries in the 'syslog'?  you may need to go back to the log that covers the reboot or perhaps the one immediately preceding it ('OLDsyslog').

 

Regards!

 

...JRF...

 

 

Patrick Wallek
Honored Contributor

Re: "ps -ef" displays processes running prior to last reboot

What is the output of 'who -b'?

 

That will show the date the system thinks it booted last.

Matti_Kurkela
Honored Contributor
Solution

Re: "ps -ef" displays processes running prior to last reboot

> We utilize ntp to maintain date/time synchronization

 

If you've specified a NTP server in /etc/rc.config.d/netdaemons using the NTPDATE_SERVER variable, the xntpd startup script runs "ntpdate <server>" before starting xntpd, which may shift the clock a large amount.

 

It might be that the system started with an incorrect "March 26" date, and got automatically corrected to September as the start-up scripts executed. This would leave the start-up timestamps of any processes that were started before xntpd to "March 26" values, while everything started after that would have a valid timestamp. The processes you listed all have a very low PID value and a PPID of zero, which normally means they're kernel processes. Typically they would all have started very early in the boot process.

MK