From: Jeff Smelser
Date: November 4 2005 3:37pm
Subject: Re: Mysql hidden processes
List-Archive: http://lists.mysql.com/mysql/191254
Message-Id: <200511040938.02382.tradergt@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed;
  boundary="nextPart6189368.6lypOCnlOv";
  protocol="application/pgp-signature";
  micalg=pgp-sha1
Content-Transfer-Encoding: 7bit

--nextPart6189368.6lypOCnlOv
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Friday 04 November 2005 08:06 am, Chris Wells wrote:
> /usr/lib/chkrootkit/chkproc -v -v
>
> PID  1230(/proc/1230): not in readdir output
> PID  1230: not in ps output
> CWD  1230: /var/lib/mysql
> EXE  1230: /usr/sbin/mysqld
> ... (report the same for 1231 - 1238)
> You have     9 process hidden for readdir command
> You have     9 process hidden for ps command
>
> The command `cat /proc/1230/cmdline` outputs:
>
> /usr/sbin/mysqld --basedir=3D/usr --datadir=3D/var/lib/mysql --user=3Dmys=
ql
> --pid-file=3D/var/run/mysqld/mysqld.pid --skip-locking --port=3D3306
> --socket=3D/var/run/mysqld/mysqld.sock

Isnt this just nptl showing 1 process instead of 9 because it shared? Just =
add=20
H to the ps command and you will see them.

Jeff

--nextPart6189368.6lypOCnlOv
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBDa4BaoOk9EvUvEtgRAmNiAKDFdkiYQlIxMkq9WxYfac1VKoioSACaA22q
/j/d6RPEGKN/StC47KNE7cY=
=W9jz
-----END PGP SIGNATURE-----

--nextPart6189368.6lypOCnlOv--