Re: [sleuthkit-users] Zombies

[Brian C. <ca...@sl...>]

>
> OK - tried it with konqueror - openend an existing case and got this :
>
> root     19727  1.7  2.6 10472 6680 pts/2    S    20:12   0:01 
> /usr/bin/perl
> -wT ./autopsy 9000 localhost
> root     19822  0.2  0.0     0    0 pts/2    Z    20:13   0:00 [autopsy
> <defunct>]
> root     19825  0.7  0.0     0    0 pts/2    Z    20:13   0:00 [autopsy
> <defunct>]
>
> The good news - using lynx doesn't cause the same problem. I wonder if 
> there's
> something out of spec about the way konqueror and mozilla are handling 
> the
> HTTP streams - would the HTTP version matter ? (I'm wondering about
> keepalives).

I know I previously ran into systems that would have tons of children 
processes because the parent wasn't getting the signal and the 'wait' 
command was never run, but I can't think of which system it was.  The 
'lynx' testing may not have generated as many zombies because it won't 
download the images for the buttons.  Did this happen with the previous 
version of Autopsy too?  I changed some of the signal handling in the 
last version so that a '.' is printed when the system is performing big 
operations like searching and calculating MD5 hashes.  I can't imagine 
that would cause the child signal to be ignored though.

I can't recreate it here with Redhat 8 or OS X.  It could be an HTTP 
thing.  I haven't been using a Perl module for HTTP, but maybe I should 
:).  I'll look into that since I am doing a big redesign of Autopsy 
right now.

thanks,
brian