Bug#474114: logrotate: becomes <defunct> / a zombie at night
Christian Pernegger
Version: 3.7.1-3
Severity: normal
I keep getting the following line from ps aux
root 9228 0.0 0.0 0 0 ? Z 06:25 0:00 [logrotate] <defunct>
It's not there directly after a reboot, but only appers over night, which implicates
cron somewhat. I also have a lot of cron related processes, though that may be normal:
root 8804 0.0 0.0 20812 1056 ? Ss 00:20 0:00 /usr/sbin/cron
root 9172 0.0 0.0 29472 1108 ? S 06:25 0:00 /USR/SBIN/CRON
root 9173 0.0 0.0 8852 1136 ? Ss 06:25 0:00 /bin/sh -c test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
root 9176 0.0 0.0 8856 572 ? S 06:25 0:00 /bin/sh -c test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
root 9177 0.0 0.0 3824 696 ? S 06:25 0:00 run-parts --report /etc/cron.daily
Thanks,
C.
-- Package-specific info:
Contents of /etc/logrotate.d
insgesamt 32
-rw-r--r-- 1 root root 141 29. Mär 2007 acpid
-rw-r--r-- 1 root root 84 16. Feb 23:26 apt
-rw-r--r-- 1 root root 79 9. Jän 06:46 aptitude
-rw-r--r-- 1 root root 111 26. Jän 21:37 dpkg
-rw-r--r-- 1 root root 273 30. Jän 19:18 exim4-base
-rw-r--r-- 1 root root 330 25. Jän 16:26 samba
-rw-r--r-- 1 root root 68 18. Dez 15:37 scrollkeeper
-rw-r--r-- 1 root root 285 5. Dez 17:10 stunnel4
-- System Information:
Debian Release: lenny/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.22-3-amd64 (SMP w/2 CPU cores)
Locale: LANG=de_AT.UTF-8, LC_CTYPE=de_AT.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages logrotate depends on:
ii base-passwd 3.5.17 Debian base system master password
ii cron 3.0pl1-104 management of regular background p
ii libc6 2.7-6 GNU C Library: Shared libraries
ii libpopt0 1.10-3 lib for parsing cmdline parameters
ii libselinux1 2.0.59-1 SELinux shared libraries
Versions of packages logrotate recommends:
ii bsd-mailx [mailx] 8.1.2-0.20071201cvs-2 A simple mail user agent
-- no debconf information
--
To UNSUBSCRIBE, email to debian-bugs-...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Paul Martin
> I keep getting the following line from ps aux
>
> root 9228 0.0 0.0 0 0 ? Z 06:25 0:00 [logrotate] <defunct>
>
> It's not there directly after a reboot, but only appers over night, which
> implicates cron somewhat. I also have a lot of cron related processes,
> though that may be normal:
No, it's not normal at all. It suggests a fault elsewhere. Are there any
oddities showing in dmesg output or in /var/log/daemon.log ?
How full is the partition /var is on?
Zombies happen because a process has exited, but the process that's started
them hasn't called wait() or waitpid() to get its exit status.
When it happens again, do "ps -l <pid>" (in the case above it would be "ps
-l 9228") to find out the parent PID of the zombie, then find out from that
PID which process the kernel thinks should be picking up the exitcode.
--
Paul Martin <p...@debian.org>
Christian Pernegger
> oddities showing in dmesg output or in /var/log/daemon.log ?
No, nothing.
> How full is the partition /var is on?
/dev/mapper/sda2_crypt 15G 4,8G 9,2G 35% /
Should be plenty of space.
> When it happens again, do "ps -l <pid>"
Will do. Is it save to run 'sudo sh -c 'cd / && run-parts --report
/etc/cron.daily' " manually to try and trigger it or is that
detrimental in some way?
At the moment I'm rather suspecting stunnel4 - it has a file in
/etc/logrotate.d, it's not on my other boxes, which are fine, and
today's zombie went away after I had to issue /etc/init.d/stunnel4
restart manually for another reason.
... ...
Actually this might be related to
#419992 (lighttpd causing logrotate to go <defunct>) and
#460019 (stunnel4 outputs to stderr)
I'll try to verify if that's indeed the cause.
Thanks,
C.
Christian Pernegger
F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND
0 0 10494 10443 18 0 0 0 exit Z ? 0:00
[logrotate] <defunct>
$ ps -l 10443
F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND
0 0 10443 10442 18 0 3824 692 - S ? 0:00
run-parts --report /etc/cron.daily
Does that help?
Christian Pernegger
No, it does not. Same as before.