[BlueOnyx:14454] Re: updatedb strange behavior

[Dirk Estenfeld]

Michael,

sorry form my late reply.
Here are the results of the tests:


> 2.) Verify the integrity of your PS command via "rpm -V procps". 
> It should come back blank without flagging any of the files that this RPM contains.

rpm -V procps
S.5....T.    /bin/ps


> Find out which path "updatedb" usually has:

which updatedb
/usr/bin/updated


> 4.) Use "lsof" to see which files, pipes, devices and/or sockets are 
> held open by the process with the PID you noted:

lsof -nl|grep 19806
updatedb  19806        0  cwd       DIR              253,0      4096          2 /
updatedb  19806        0  rtd       DIR              253,0      4096          2 /
updatedb  19806        0  txt       REG              253,0    592464      67098 /root/gpu/updatedb (deleted)
updatedb  19806        0  mem       REG              253,0    156928     303158 /lib64/ld-2.12.so
updatedb  19806        0  mem       REG              253,0   1926800     303663 /lib64/libc-2.12.so
updatedb  19806        0  mem       REG              253,0    145896     305799 /lib64/libpthread-2.12.so
updatedb  19806        0  mem       REG              253,0     47064     306403 /lib64/librt-2.12.so
updatedb  19806        0    0r      CHR                1,3       0t0       3662 /dev/null
updatedb  19806        0    1w      CHR                1,3       0t0       3662 /dev/null
updatedb  19806        0    2w      CHR                1,3       0t0       3662 /dev/null
updatedb  19806        0    3u     IPv4          273202025       0t0        TCP <myip>:57006->184.106.96.142:domain (ESTABLISHED)


> 5.) If lsof says it's the same /usr/bin/updatedb, we verify its integrity as well:

rpm -q --whatprovides /usr/bin/updatedb
mlocate-0.22.2-4.el6.x86_64


> 6.) You also might want to check the directory /proc/<PID>/

ls -la /proc/13816
total 0
dr-xr-xr-x   7 root root 0 Feb  7 06:15 .
dr-xr-xr-x 163 root root 0 Nov  5 13:59 ..
dr-xr-xr-x   2 root root 0 Feb  7 08:40 attr
-rw-r--r--   1 root root 0 Feb  7 08:40 autogroup
-r--------   1 root root 0 Feb  7 08:40 auxv
-r--r--r--   1 root root 0 Feb  7 08:40 cgroup
--w-------   1 root root 0 Feb  7 08:40 clear_refs
-r--r--r--   1 root root 0 Feb  7 08:05 cmdline
-rw-r--r--   1 root root 0 Feb  7 08:40 coredump_filter
-r--r--r--   1 root root 0 Feb  7 08:40 cpuset
lrwxrwxrwx   1 root root 0 Feb  7 08:40 cwd -> /
-r--------   1 root root 0 Feb  7 08:40 environ
lrwxrwxrwx   1 root root 0 Feb  7 07:50 exe -> /root/gpu/updatedb (deleted)
dr-x------   2 root root 0 Feb  7 08:40 fd
dr-x------   2 root root 0 Feb  7 08:40 fdinfo
-r--------   1 root root 0 Feb  7 08:40 io
-rw-------   1 root root 0 Feb  7 08:40 limits
-rw-r--r--   1 root root 0 Feb  7 08:40 loginuid
-r--r--r--   1 root root 0 Feb  7 08:40 maps
-rw-------   1 root root 0 Feb  7 08:40 mem
-r--r--r--   1 root root 0 Feb  7 08:40 mountinfo
-r--r--r--   1 root root 0 Feb  7 08:40 mounts
-r--------   1 root root 0 Feb  7 08:40 mountstats
dr-xr-xr-x   5 root root 0 Feb  7 08:40 net
-r--r--r--   1 root root 0 Feb  7 08:40 numa_maps
-rw-r--r--   1 root root 0 Feb  7 08:40 oom_adj
-r--r--r--   1 root root 0 Feb  7 08:40 oom_score
-rw-r--r--   1 root root 0 Feb  7 08:40 oom_score_adj
-r--r--r--   1 root root 0 Feb  7 08:40 pagemap
-r--r--r--   1 root root 0 Feb  7 08:40 personality
lrwxrwxrwx   1 root root 0 Feb  7 08:40 root -> /
-rw-r--r--   1 root root 0 Feb  7 08:40 sched
-r--r--r--   1 root root 0 Feb  7 08:40 schedstat
-r--r--r--   1 root root 0 Feb  7 08:40 sessionid
-r--r--r--   1 root root 0 Feb  7 08:40 smaps
-r--r--r--   1 root root 0 Feb  7 08:40 stack
-r--r--r--   1 root root 0 Feb  7 08:05 stat
-r--r--r--   1 root root 0 Feb  7 08:40 statm
-r--r--r--   1 root root 0 Feb  7 08:40 status
-r--r--r--   1 root root 0 Feb  7 08:40 syscall
dr-xr-xr-x   6 root root 0 Feb  7 08:40 task
-r--r--r--   1 root root 0 Feb  7 08:40 wchan



This looks not really good.

Michael, what do you think about this?

Regards,
Dirk


-----------------------------------------------
Black Point Arts Internet Solutions GmbH - Hanauer Landstrasse 423a - 60314 Frankfurt