From: Naresh (cknaresh@yahoo.com)
Date: Wed Mar 24 2004 - 09:04:39 EST
Hi All,
I tried ps after copying ps from other machine , the
o/p is as follows,
bash-2.03$
bash-2.03$
bash-2.03$ ps -eaf
UID PID PPID C STIME TTY TIME CMD
root 0 0 0 Jul 15 ? 0:17 sched
root 1 0 0 0:16
<defunct>
root 2 0 0 Jul 15 ? 0:00 pageout
root 3 0 2 Jul 15 ? 627:20
fsflush
root 303 1 0 Jul 15 ? 0:00
/usr/lib/saf/sac -t 300
root 291 1 0 Jul 15 ? 0:00
/usr/dt/bin/dtlogin -daemon
root 173 1 0 Jul 15 ? 0:01
/usr/lib/autofs/automountd
root 59 1 0 Jul 15 ? 0:00
/usr/lib/sysevent/syseventd
root 70 1 0 Jul 15 ? 0:00
/usr/lib/picl/picld
root 130 1 0 Jul 15 ? 0:01
/usr/sbin/rpcbind
root 204 1 0 Jul 15 ? 0:30
/usr/sbin/nscd
root 169 1 0 Jul 15 ? 0:00
/usr/lib/nfs/lockd
daemon 170 1 0 Jul 15 ? 0:00
/usr/lib/nfs/statd
root 211 1 0 Jul 15 ? 0:00
/usr/lib/lpsched
iroute 28769 1 0 0:00
<defunct>
root 183 1 0 Jul 15 ? 0:01
/usr/sbin/syslogd
root 160 1 0 Jul 15 ? 1:06
/usr/sbin/inetd -s
root 189 1 0 Jul 15 ? 0:01
/usr/sbin/cron
root 224 1 0 Jul 15 ? 0:00
/usr/lib/power/powerd
root 248 1 0 Jul 15 ? 0:00
/usr/sbin/vold
root 233 1 0 Jul 15 ? 0:01
/usr/lib/utmpd
root 26730 1 0 0:00
<defunct>
iroute 28770 1 0 0:00
<defunct>
root 294 1 0 Jul 15 ? 0:00
/usr/lib/dmi/dmispd
root 261 1 0 Jul 15 ? 0:00
/usr/lib/efcode/sparcv9/efdaemon
root 29556 160 0 08:38:01 ? 0:00
in.telnetd
root 276 1 0 Jul 15 ? 0:00
/usr/sbin/in.rarpd -a
root 278 1 0 Jul 15 ? 0:00
/usr/sbin/rpc.bootparamd
root 285 1 0 Jul 15 ? 0:00
/usr/lib/snmp/snmpdx -y -c /etc/snmp/conf
root 288 285 0 Jul 15 ? 21:55 mibiisa
-r -p 32781
iroute 29285 1 0 0:00
<defunct>
root 28500 1 0 0:01
<defunct>
root 304 1 0 Jul 15 console 0:00
/usr/lib/saf/ttymon -g -h -p iroute-01 console login:
-T sun -d /dev/console -
iroute 29507 1 0 0:00
<defunct>
root 297 1 0 Jul 15 ? 0:00
/usr/lib/dmi/snmpXdmid -s iroute-01
iroute 29558 29556 0 08:38:01 pts/1 0:00 -sh
iroute 11354 1 0 0:02
<defunct>
root 28499 1 0 0:00
<defunct>
iroute 28763 1 0 0:01
<defunct>
iroute 24303 1 0 0:01
<defunct>
root 26859 1 0 0:00
<defunct>
iroute 29501 1 0 0:00
<defunct>
iroute 28880 1 0 0:00
<defunct>
iroute 29283 1 0 0:00
<defunct>
root 28492 1 0 0:00
<defunct>
iroute 13596 13578 1 Mar 19 ? 29:16
./iRoute
root 29543 160 0 08:35:11 ? 0:00
in.telnetd
root 18669 1 0 Mar 22 ? 2:00
/usr/java/bin/../bin/../jre/bin/../bin/sparc/native_threads/java
-Dviper.fifo.p
iroute 29562 29558 0 08:38:07 pts/1 0:00 bash
root 29555 160 0 08:37:37 ? 0:00 in.ftpd
iroute 28843 1 0 0:00
<defunct>
iroute 1242 1 0 1:29
<defunct>
iroute 28921 28916 0 05:35:26 pts/11 0:00 bash
iroute 29281 1 0 0:00
<defunct>
iroute 13578 1 0 Mar 19 ? 0:00 bash
root 28498 1 0 0:00
<defunct>
root 26731 1 0 0:51
<defunct>
root 18621 160 0 Mar 22 ? 0:00 dcs
iroute 24315 1 0 0:05
<defunct>
iroute 29528 1 0 0:00
<defunct>
iroute 29279 1 0 0:00
<defunct>
iroute 28756 1 0 0:00
<defunct>
iroute 28768 1 0 0:00
<defunct>
iroute 28874 1 0 0:00
<defunct>
iroute 28767 1 0 0:00
<defunct>
iroute 29419 1 0 0:32
<defunct>
iroute 29398 1 0 0:04
<defunct>
iroute 29082 1 0 0:00
<defunct>
iroute 28916 28914 0 05:35:22 pts/11 0:00 -sh
nobody 18553 160 0 Mar 22 ? 0:00 fs
root 29545 29543 0 08:35:11 pts/2 0:00 -sh
root 29568 29562 0 08:39:30 pts/1 0:00 ps -eaf
iroute 28879 1 0 0:00
<defunct>
root 18590 160 0 Mar 22 ? 0:00
rpc.ttdbserverd
iroute 28838 1 0 0:00
<defunct>
root 18680 160 0 Mar 22 ? 0:00
rpc.metad
root 28914 160 0 05:35:22 ? 0:00
in.telnetd
root 18566 160 0 Mar 22 ? 0:00
rpc.metamhd
iroute 28954 1 0 0:00
<defunct>
root 18611 160 0 Mar 22 ? 0:00
dr_daemon
iroute 28955 1 0 0:00
<defunct>
iroute 28950 1 0 0:00
<defunct>
root 26864 1 0 0:00
<defunct>
iroute 28956 1 0 0:00
<defunct>
iroute 11492 1 0 0:11
<defunct>
iroute 28957 1 0 0:00
<defunct>
iroute 29086 1 0 0:00
<defunct>
iroute 28977 1 0 0:00
<defunct>
iroute 28972 1 0 0:00
<defunct>
iroute 28978 1 0 0:00
<defunct>
iroute 28979 1 0 0:00
<defunct>
iroute 28980 1 0 0:00
<defunct>
iroute 29087 1 0 0:00
<defunct>
iroute 29088 1 0 0:00
<defunct>
iroute 29089 1 0 0:00
<defunct>
iroute 29103 1 0 0:00
<defunct>
iroute 29099 1 0 0:00
<defunct>
iroute 29104 1 0 0:00
<defunct>
iroute 29105 1 0 0:00
<defunct>
iroute 29106 1 0 0:00
<defunct>
iroute 29120 1 0 0:00
<defunct>
iroute 29116 1 0 0:00
<defunct>
iroute 29121 1 0 0:00
<defunct>
iroute 29122 1 0 0:00
<defunct>
iroute 29123 1 0 0:00
<defunct>
iroute 29137 1 0 0:00
<defunct>
iroute 29133 1 0 0:00
<defunct>
iroute 29138 1 0 0:00
<defunct>
iroute 29139 1 0 0:00
<defunct>
iroute 29140 1 0 0:00
<defunct>
iroute 29154 1 0 0:00
<defunct>
iroute 29150 1 0 0:00
<defunct>
iroute 29155 1 0 0:00
<defunct>
iroute 29156 1 0 0:00
<defunct>
iroute 29157 1 0 0:00
<defunct>
iroute 29171 1 0 0:00
<defunct>
iroute 29167 1 0 0:00
<defunct>
iroute 29172 1 0 0:00
<defunct>
iroute 29173 1 0 0:00
<defunct>
iroute 29174 1 0 0:00
<defunct>
I would like to know wha is the defunct message and
its impact on the system.
Kindly help.
Thanks & regards,
Naresh.
--- Stepan Kucherenko <twohalf@dtd.peterstar.com>
wrote:
> >
> > bash-2.03$ df
> > / (/dev/dsk/c0t2d0s0 ):20038558
> > blocks 1237185 files
> > /usr (/dev/dsk/c0t2d0s3 ):14573114
> > blocks 953747 files
> > /proc (/proc ): 0
> > blocks 15777 files
> > /dev/fd (fd ): 0
> > blocks 0 files
> > /etc/mnttab (mnttab ): 0
> > blocks 0 files
> > /var (/dev/dsk/c0t2d0s4 ):13917450
> > blocks 865359 files
> > /var/run (swap ): 5158768
> > blocks 109490 files
> > /tmp (swap ): 5158768
> > blocks 109490 files
> > /export/home (/dev/md/dsk/d50 ):78524440
> > blocks 6059512 files
> > bash-2.03$
> >
> > My df command o/p is attached above. Thanks for
> the
> > great finding , I checked other files as well and
> > found that su,vi,clear and a lot of other files
> were
> > of null size as well but mostly simple application
> > programs.
> >
> > Kindly let me know if any hacker has hacked in or
> any
> > other thing bcos of it , again also let me know if
> I
> > can copy these files from other systems which will
> > solve the problem.
> >
> > pls help.
> This file (vi) was changed Mar 24 at 03:47, try to
> look at change time of
> other null size files.
> Do a `last` command (if it will work and if it is
> not null sized), and look
> at 3:xx time of Mar 24, you will see who was sitting
> on server at this time.
> If you have process accounting turned on, you may
> look at `lastcomm` command
> output.
>
> Yes, you can transfer this files from another
> machine, but you must
> investigate situation first.
> Transfer most valuable files at least, and look at
> system closely, try to
> find what was the cause of this problem.
> Do not forget to do `chmod +x filename` on ftp'ed
> files, because ftp drops
> exacutable bit on transfer.
> And, of course, do not forget about binary mode in
> ftp.
>
> Have you installed recommended patch kit for your
> Solaris version ? Have you
> looked at security notifications and closed holes ?
>
>
> You have a metadevices on your server (/dev/md), so
> you have dome mirroring,
> stripping or something else for your hard drives.
> Send `metastat` output, may be it is cause of
> problem.
>
> Send me contents of /var/adm/messages file from last
> reboot (or just `dmesg`
> command output), especially parts of it near Mar 24
> 3:47 time.
>
>
>
__________________________________
Do you Yahoo!?
Yahoo! Finance Tax Center - File online. File on time.
http://taxes.yahoo.com/filing.html
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers
This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 23:28:20 EDT