Too Many Processes open / What do to?

[Martijn van Oosterhout]

On Sun, Oct 07, 2001 at 07:36:46PM +1000, Neil Symons wrote:
> 
> Has anyone experienced when processes don't die and eventually causes
> process count to fill up to an extent where the whole system stops
> working?

Can't say I have.

> It now happens often and I think its some sort of exploit being executed
> as the system has not changed in a while and this only happens during
> times where someone capable of getting the system up is around?
> 
> Most of the processes left are /USR/SBIN/CRON and /usr/sbin/in.qpopper
> The processes run and return to ownership of root, but are no longer required.

Are the processes in D state? IOW, can you kill them? qpopper has been known
to hang forever on corrupted mail spool files. If someone was fetching mail
and their connection drops out, the daemon may hang around for a while.

As for cron, it can get stuck for any number of reasons. Is there a process
beneath it that it stuck? The other possibility is that it's trying to send
an email and it's not working.

> Anyone has a suggestion to what I need to look for?

You can use strace to see what the processes are waiting for. lsof and
netstat are good for tracking down stuck network connections.

HTH,
-- 
Martijn van Oosterhout <kleptog at svana.org>
http://svana.org/kleptog/
> Magnetism, electricity and motion are like a three-for-two special offer:
> if you have two of them, the third one comes free.