Process date weirdness on linux
This is a little weird.. never seen this problem before on a linux box (or any other unix box for that matter) and I couldn't find anything on the almighty google.. (if you can't find it with google, does it exist?).
[root@ ~]# date
Thu Apr 3 21:54:41 EST 2003
[root@ ~]# ps -ef | grep ps
root 28932 28595 0 Mar20 ttypb 00:00:00 ps -ef
root 28933 28595 0 Mar20 ttypb 00:00:00 grep ps
Rebooting the box made it go away (eek, rebooting to fix a linux problem).. but it still bothers me that I can't find the cause for it..
Comments
ooooo.... that's spooky, isn't it?
What kernel are you running? And what was the last reboot before the one that fixed this?
Posted by: bdh | April 4, 2003 12:59 AM
odd
Posted by: apokalyptik | April 4, 2003 10:59 AM
When I get weirdness like that, I say to heck with "ps" and I just go digging around in /proc . Depending on your distribution, "ps" itself might just go digging around in /proc as well. If that's the case, it could be a variety of things:
1) /proc needs the equivalent of an fsck (which sounds odd, but when you remember that it is just another filesystem with inodes and the like, it isn't so odd), which a reboot does
2) you've got some weird caching/race-condition going on when reading from /proc such that only part of the date got written to the region of memory that that "file" under /proc corresponded to as all of it was being read.
3) you've got some old kernel module around in memory that thinks the process time structure is slightly different than what it is - if the reboot rebuilt your module list you may not be able to ever repeat this
4) possible, but unlikely - a memory based hack/worm that sets up a separate process and hacks the part of the kernel that lists the processes so that it won't be listed exhibits the same problem as in (3).
#4 is highly unlikely as all such things that I've come across (usually due to script kiddies) don't hack the kernel but instead replace the "ps" executable, which leaves /proc intact (hence why I always go digging there if something doesn't make sense).
Whatever it was, if you ever find out, be sure to let us know.
Posted by: Andrew | April 4, 2003 11:00 AM
root 1413 1387 0 17:26 pts/2 00:00:00 ps -ef
root 1414 1387 0 17:26 pts/2 00:00:00 grep ps
[root@localhost kevin]#
hay me 2...... ehh?..... (rh8.0)
Posted by: Kevin | April 4, 2003 05:30 PM
Kevin, the problem is the process date.. yours look fine, mine apparently thinks I ran the ps back on March 20th :)
Posted by: kasia | April 4, 2003 09:20 PM
Aie, me feel better now. Twas herding Java applets all week. First for me.
Posted by: Kevin | April 4, 2003 09:26 PM