Re: [sleuthkit-users] Zombies

[Angus M. <an...@n-...>]

On Monday 15 December 2003 07:35, Brian Carrier wrote:
> On Saturday, December 13, 2003, at 08:04  AM, Angus Marshall wrote:
> > I've been running some fairly long analysis sessions using Autopsy
> > 1.75/Sleuthkit 1.66 recently and have noticed my system running slower
> > and
> > slower over time.....
> >
> > Checking ps shows that there are a *lot* of zombied processes hanging
> > around
> > in the system. Closer inspection suggeste it may be some unwanted
> > interaction
> > between KDE-launched mozilla and autopsy in fact. Here's the ps output
> > for
> > the latest session (just started) :
>
> Wow, these all exist just from opening the main menu window?  Autopsy
> does a wait for the children processes, so I wonder what is unique
> about this setup that causes the children to stay around.  I'm
> surprised that Mozilla is in a non-zombie state.  I'll add a bug entry
> and look into this.  Can you try a different browser and see if the
> same thing happens (lynx will even work).

OK - tried it with konqueror - openend an existing case and got this : 

root     19727  1.7  2.6 10472 6680 pts/2    S    20:12   0:01 /usr/bin/perl 
-wT ./autopsy 9000 localhost
root     19822  0.2  0.0     0    0 pts/2    Z    20:13   0:00 [autopsy 
<defunct>]
root     19825  0.7  0.0     0    0 pts/2    Z    20:13   0:00 [autopsy 
<defunct>]

The good news - using lynx doesn't cause the same problem. I wonder if there's 
something out of spec about the way konqueror and mozilla are handling the 
HTTP streams - would the HTTP version matter ? (I'm wondering about 
keepalives). Interestingly - they're not what I was brought up to consider 
real zombies. They do die when the parent process is killed.