Subject: Process weirdness in Solaris 2.5.1

From: Andy Ellsworth <[email-masked]>
Date: Fri, 4 Oct 1996 14:38:27 -0500 (CDT)

We're having an odd problem with 2.4.2 beta 11 and Solaris 2.5.1.  We're
getting large numbers of root-owned ftpd processes above and beyond our
limit in ftpaccess.  Let me illustrate:

# ftpcount
Service class local                -  10 users ( 40 maximum)
Service class remote               - 300 users (300 maximum)

# ps -ef |grep ftpd |wc -l
     393

# ps -ef |grep ftpd |grep root |wc -l
      93

As you can see, we have a large number of ftpd processes that are owned by
root and aren't getting counted by ftpcount.  The ones that do get counted
are always owned correctly, by user ftp (or a non-anonymous user).  If I
go through and kill all of the root-owned ftp processes, they immediately
start to build back up.

Anyone seen this sort of thing before?  It's certainly got me stumped...

+----------------------------------------------------------------------------+
| Andy Ellsworth  |  [email-masked] |  Admin/Cyberdiplomat, Wuarchive    |
+----------------------------------------------------------------------------+
|  "...The wind was not the beginning.  There are neither beginnings nor     |
| endings to the turning of the Wheel of Time.  But it was _a_ beginning..." |
|                                   --The Wheel of Time saga, Robert Jordan  |
+----------------------------------------------------------------------------+

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Sun, 6 Oct 1996 21:16:42 +0200 (MET DST)

> go through and kill all of the root-owned ftp processes, they immediately

Could these be the ones that are waiting for user/pass but aren't logged
in yet ? Which means the're all going to see the message 'the maximum number
of anonymous ftp sessions ...'.

Maybe some browser used for visiting your site doesn't close the connection
even when getting an user anonymous access denied.

With Solaris you could try /usr/ucb/ps to see which process state wu-ftpd
is in.

                                                      Grtx KH

-- 
  Koos van den Hout,     Internetter, Unix freak, ISFJ and BBS SysOp at large
  [email-masked] (Home)        BBS Koos z'n Doos (+31-30-6036637 28k8)
  [email-masked] (Work)  <-- finger -l for PGPkey    (+31-30-6056619 14k4)
  http://www.hvu.nl/~koos (WWW)    Looking for a license plate with "RFC 822"
  Unix op z'n NL's : Segment overtreding - kern uitgescheten       KH106-RIPE

---

From: Andy Ellsworth <[email-masked]>
Date: Mon, 7 Oct 1996 16:04:37 -0500 (CDT)

> of anonymous ftp sessions ...'.

If it weren't for the fact that a lot of these processes hang around for
hours, I'd say that you've hit it on the head.  It does explain -most- of
the root owned processes, but not all... 

> even when getting an user anonymous access denied.

Quite possibly.  Either that, or some wu-ftpd processes aren't timing out
the login correctly...

> With Solaris you could try /usr/ucb/ps to see which process state wu-ftpd

Yeah, I did know about that command :)  They're all simply "sleeping",
which doesn't say much I'm afraid.