Changing ppid values and zombies

[Chris O'Neal]

I have encountered a situation I previously thought impossible, that is ppid value for pid changes during life of pid.

I have written a korn shell script that runs on...

$ uname -a
HP-UX hqetlsu1 B.11.11 U 9000/800 12842844 unlimited-user license

The script kills zombie processes id by the following rules;
- Data is obtained by command ps –ef as root to a file.
- Process is owned by btbbatch &
- Process name is phantom w/ arg DSD.StageRun &
- Process' parent pid is 1

Developers are reporting that my script is killing legitimate pids.

After commenting out the call to the kill command within the script and running a second script collecting ps –ef data 5 minutes after the killer script, I have obtained data showing that the ppid on some of the processes goes from 1 to a legitimate value.

Ps –ef data from killer script at 21:46 system time...
2005/01/28 21:46:22 - KILLED - btbbatch 14366 1 234 21:39:44 ? 4:01 phantom DSD.StageRun jbBTBCreateAcctXrefWithFirm. jbBTBCreateAc

Ps –ef data from screen capture at 21:52 system time...
$ date
Fri Jan 28 21:52:16 EST 2005
$ ps -ef | grep 14366
btbbatch 14366 14335 255 21:39:44 ? 9:08 phantom DSD.StageRun jbBTBCreateAcctXrefWithFirm. jbBTBCreateAc

You can see from the above that pid 14366 started at 21:39 changed ppid from 1 @ 21:46 to ppid of 14335 @ 21:52. I know that pid 14366 is for the same process in both of these outputs because both listings have the same process start time of 21:36:44.

I thought that a ppid was static for the life of a pid. But my data is showing different.

How is the ppid value changing?
How do I check for true zombies in this situation?

[harry d brown jr]

When the Parent dies and the child lives, then Social Security kicks in and the Government (PID = 1) dictates who the child is to report to.


live free or die
harry d brown jr

[A. Clay Stephenson]

First of all, trying to kill a zombie process is utterly pointless; the processes, by definition, are already dead and in any event can certainly no longer respond to a signal. Moreover, the only resource consumed by a zombie is a slot in the process table so there's no real harm unless you have so many that the kernel's process table is full. The only time that the ppid can change after the fork() that created a process is when the parent process dies. It that case, the orphaned processes are assigned to init (pid 1).

[Chris O'Neal]

Well, all is still well with the world.

I am embarrassed, but my problem of ppid changing to a value of 1 and then back to another valid value turned out to be false data caused by an error in my script.

The script problem was discovered when data feed was changed from a pipe from ps -ef to a file made by ps -ef.

The typo was in an awk select statement having $3 = 1 instead of $3 == 1.

Sample test....

$ cat data
A 1 1
B 2 1
C 3 3
D 4 4

$ awk '$3 = 1 { print $0 }' data
A 1 1
B 2 1
C 3 1
D 4 1

$ awk '$3 == 1 { print $0 }' data
A 1 1
B 2 1

My mind did not switch from korn shell syntax to awk syntax like it normally does. In korn scripts, to test if two string vars have the same values the syntax is;

"$VAR1" = "$VAR2"

In awk scripts, it is;

"$VAR1" == "$VAR2"

And I did not know that in awk you can change a data value in the input data before it is computed. I had expected that if I had bad/wrong syntax in the awk selection statement it would produced a script crash with a syntax error message. But instead I learned that awk can manipulate your raw input data in the data selection statement itself before it even gets to your code logic between the { } for that selection.

While I was trying to trouble shoot this problem as an OS issue between pid and ppid, I found the following info on the web which I was good reading and might be helpful to others.

The link below has info about spawn child processes and their problems (start reading at page 50)

http://www.web-insights.net/env_audit/environments.pdf

The link below (section 1.5, 1.6, 1.15, 1.16) has info on pid and ppids in as handled by programs. It helped me form questions to ask the vendor had the issue been OS related. Recommends use of ps â efl to check values found in column â Fâ .

http://www.erlenstar.demon.co.uk/unix/faq_2.html

The link below has a simple explanation of "zombie" and recommends use of waitpid() over wait().

http://www-h.eng.cam.ac.uk/help/tpl/unix/fork.html

The link below has a flow diagram showing the seven-state logical process model a unix pid can be, which includes zombie.

http://www.cim.mcgill.ca/~franco/OpSys-304-427/lecture-notes/node16.html

The link below explains the relationship between defunct and zombie.

http://www.webmasterworld.com/forum40/1032.htm

Sorry for the false alarm. I feel bad about this.

Than

[Chris O'Neal]

See my posting above. Thank you all.