On 05/08/2019 13:44, John Horne wrote:
> On Mon, 2019-08-05 at 13:06 +0100, Giles Coochey wrote:
>> On 05/08/2019 12:56, John Horne wrote:
>>
> I was going to say no to both of these, however the RPM package ('xymon') was
> itself updated at around the time mentioned on Aug 02.
> The hex number is equivalent to 1564754190 in decimal which, as an epoch time,
> is '2019-08-02 14:56:30'. So it might be possible that '/usr/sbin/xymond' was
> replaced and the hex number just indicates the time that occurred.
It might be explained that the file doesn't get deleted until its file
handles are released?
>
> The downside is that the package update was a bit earlier than 14:56 though, so
> the numbers don't seem to quite match up. Secondly, the whole xymon process was
> restarted, but the server itself not rebooted, so I would expect all the
> processes to be using the new executables rather than an older/deleted one. (I
> am a little loath to restart the service at the moment as I may well lose the
> info currently in '/proc/.../exe'.)
>
Did you upgrade xymon, or perhaps install it from a different
maintainers RPM from the original one, or perhaps the original one
wasn't an RPM install at all?
In these cases, the old running process in /proc/pid/exe is probably the
original one, which the new install tried to restart / but because of a
discrepancy in what is in /var/run it didn't quite work out as planned.
I think to truly understand this we might need more background
information and a journal of what tasks were carried out.