Defunct Processes

[Girish_17]

Hi All,
Can anyone tell me about DEFUNCT Processes!!
When they are created and how one can trace who created that and why?

Thank U very much for valuable suggestions !!

Regards,

[Ralph Grothe]

I think on other Unices they are called zombies.
These are processes whose parents have vanished without a syscall of wait() or waitpid() to collect the exit code of these children and remove them from the process table.
If you have lots of these zombies this is usually a sign of a piece of badly written code that produced them.
though they don't take up resources they are to avoid because they fill up your process table and can result in a system that cannot fork new processes, and thus is forced to be rebooted.

[Pete Randall]

Check the parent process ID to see who spawned them (assuming the PPID is not 1, in which case you have a zombie). As to when and how they're created, it's sloppy coding and improper termination of a program.


Pete

[Girish_17]

Pete PPID is 0 ... it's a swapper daemon i think. Any comments on this.
Thanks,

[Pete Randall]

The only comment I can think of is that swapper shouldn't be spawning any defunct processes! I don't think swapper even spawns any processes. There is something fishy going on here.


Pete

[Girish_17]

I am sorry pete ... it's not swapper and PPID is not zero. I just found it out again and it is this process:

/usr/sbin/stm/uut/bin/tools/monitor/ia64_corehw

This happens when i run one shell script.


Thanks,

[Pete Randall]

What is the shell script - what does it do?


Pete

[Bill Hassell]

Is ia64_corehw the parent of the defunct process? It is part of the online diagnostics package but other than using cstm to produce reports in batch mode, I don't think stm, mstm or xstm work well in scripts.

[Girish_17]

Bill,
How do i stop this Online Diagnostic i.e. stm. I just want to stop stm monitoring.
Regards,

[Bill Hassell · Accepted solution]

Most likely, the EMS/STM diagnostics have not been patched and/or some required system patches are missing. But to stop the EMS diagnostics, edit the files ems and emsagtconf in /etc/rc.config.d and change the =1 to =0, then reboot. Running without the online diagnostics and monitoring system is not recommended for production servers.

[Girish_17]

Hi Bill,
No its not a production server and so i don't mind stopping EMS.
I did that accordingly and rebooted the system but still see some daemons running:

diagmond (two threads)and remote monitor.

Regards,

[Girish_17]

Bill,
I found one more file in rc.config.d that is diagnostic and edited the same to make =0 change and then it disabled total diagnostics.
So in all i edited three files "ems,emsagconf and diagnostic" and made the entreis =0.

So doing this what effect it will have on the system other than monitoring hardware activity and failures? Will this stop process creation under any circumstances?

I just wanted to confirm that process was getting created by /usr/sbin/stm/uut/bin/tools/monitor/ia64_corehw daemon (well that could be issues with OS patch or Hardware malfunctioning) and not related with the Application running on the server.

Thanks and regards,
Girish

[Sanjay_6]

Hi,

Check this doc on why "ia64_corehw" is leaving those defunt child processes,

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000074246192

The itrc doc id is 8606344112.

Hope this helps.

regds

[Bill Hassell]

The defunct process is definitely due to the EMS/STM subsystem and has nothing to do with your application. Stopping the diags means that you will have to monitor your system manually for problems.