Orphan instances of process '-KSH', sftp-server

From: Wesley Joyce (Wesley.Joyce@UVI.EDU)
Date: Thu Aug 08 2002 - 17:18:11 EDT


I am running into a situation in which korn shell session are being left
running after the user is no longer logged in. I am not sure if they are
typing 'exit' at the shell prompt, of being ungracefully disconnected. But
these processes are eating up CPU cycles. It appears this only happens
with users of SSH (SSH2.0 - 3.2.0).

Notice that userh is only active on pts/3. Notice userh has PID 32186
using 34.8% of the CPU (according to topas).

usera(root)@hostname#:/users/usera[PROD]> ps -ef | grep pts/3
   userh 55092 63602 0 13:17:18 pts/3 0:00 -ksh
     root 84178 52334 1 17:12:18 pts/4 0:00 grep pts/3
   userh 87578 55092 0 13:17:30 pts/3 0:10 sqlplus

usera(root)@hostname#:/users/usera[PROD]> who
userb pts/0 Aug 08 12:45 (userb)
usera pts/2 Aug 07 07:25 (abc)
userh pts/3 Aug 08 13:17 (123)
usera pts/4 Aug 07 11:56 (xyz)
userz pts/7 Aug 08 16:22 (321)

usera(root)@hostname#:/users/usera[PROD]> ps -ef | grep ksh
   userz 12824 94802 0 16:22:15 pts/7 0:00 -ksh
     root 14196 1 0 Aug 02 - 0:00 ksh **************************
   userh 32186 47612 40 11:13:06 pts/1 119:33 -ksh
  userg 35908 1 12 16:04:50 pts/6 5:43 -ksh
     root 39774 80476 0 Aug 07 pts/2 0:00 ksh
     root 45372 63346 0 12:45:37 pts/0 0:00 -ksh
   userh 47612 1 0 11:12:49 pts/1 0:00 -ksh
     root 52334 85650 0 Aug 07 pts/4 0:00 ksh
   userh 55092 63602 0 13:17:18 pts/3 0:00 -ksh
   userd 55542 45372 0 12:46:04 pts/0 0:00 -ksh
   userd 61144 55542 0 14:27:32 pts/0 0:00 -ksh
  userb 63346 89056 0 12:45:28 pts/0 0:00 -ksh
  userg 75304 35908 0 17:04:13 pts/6 0:00 [ksh]
   usera 80476 82074 0 Aug 07 pts/2 0:00 -ksh
     root 84176 52334 2 17:04:13 pts/4 0:00 grep ksh
   usera 85650 52848 0 Aug 07 pts/4 0:00 -ksh

usera(root)@hostname#:/users/usera[PROD]> ps -ef | grep 47612
   userh 32186 47612 63 11:13:06 pts/1 119:39 -ksh
   userh 47612 1 0 11:12:49 pts/1 0:00 -ksh
     root 66280 52334 1 17:04:30 pts/4 0:00 grep 47612
usera(root)@hostname#:/users/usera[PROD]>

topas -

ksh (32186) 34.8% PgSp: 9.3mb userh % Free 79.2
ksh (35908) 12.6% PgSp: 1.5mb userg
ksh (84050) 4.0% PgSp: 2.9mb userg
topas (56622) 2.5% PgSp: 0.5mb root Press "h" for help screen.
****** (36648) 1.0% PgSp: 1.5mb ****** Press "q" to quit program.
sshd2 (94802) 0.5% PgSp: 1.0mb root
****** (49882) 0.0% PgSp: 1.4mb ******
init (1) 0.0% PgSp: 0.6mb root
**** (1032) 0.0% PgSp: 0.0mb root
****** (17288) 0.0% PgSp: 0.7mb root
cron (11104) 0.0% PgSp: 0.3mb root
*********(25284) 0.0% PgSp: 0.0mb ******
****** (66522) 0.0% PgSp: 1.5mb ******
*** (1548) 0.0% PgSp: 0.0mb root
***** (4432) 0.0% PgSp: 0.1mb root
******* (24066) 0.0% PgSp: 1.1mb root

All these old instances of sftp-server, but there not taking up any CPU
cycles. PID 32186 sure is though.

ps -ef | grep userh
   userh 30726 63602 0 15:35:34 - 0:00 /usr/local/bin/sftp-server
   userh 32186 47612 34 11:13:06 pts/1 123:10 -ksh
   userh 36390 63602 0 15:04:16 - 0:00 /usr/local/bin/sftp-server
   userh 47612 1 0 11:12:49 pts/1 0:00 -ksh
   userh 51760 63602 0 15:33:04 - 0:00 /usr/local/bin/sftp-server
   userh 55092 63602 0 13:17:18 pts/3 0:00 -ksh
   userh 55666 63602 0 13:17:18 - 0:00 /usr/local/bin/sftp-server
   userh 57888 32186 0 Dec 31 - 0:00 []
   userh 75260 63602 0 15:22:19 - 0:00 /usr/local/bin/sftp-server
   userh 79486 63602 0 15:20:11 - 0:00 /usr/local/bin/sftp-server
     root 84058 52334 1 17:15:08 pts/4 0:00 grep userh
   userh 87578 55092 0 13:17:30 pts/3 0:10 sqlplus
   userh 93194 63602 0 14:42:16 - 0:00 /usr/local/bin/sftp-server
   userh 93586 63602 0 15:57:05 - 0:00 /usr/local/bin/sftp-server

ANY IDEAS?


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.381 / Virus Database: 214 - Release Date: 8/2/2002


This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 22:16:08 EDT