[CentOS] Peculiar process name in /proc

[Giles Coochey]

On 05/08/2019 13:44, John Horne wrote:
> On Mon, 2019-08-05 at 13:06 +0100, Giles Coochey wrote:
>> On 05/08/2019 12:56, John Horne wrote:
>>
> I was going to say no to both of these, however the RPM package ('xymon') was
> itself updated at around the time mentioned on Aug 02.
> The hex number is equivalent to 1564754190 in decimal which, as an epoch time,
> is '2019-08-02 14:56:30'. So it might be possible that '/usr/sbin/xymond' was
> replaced and the hex number just indicates the time that occurred.
It might be explained that the file doesn't get deleted until its file 
handles are released?
>
> The downside is that the package update was a bit earlier than 14:56 though, so
> the numbers don't seem to quite match up. Secondly, the whole xymon process was
> restarted, but the server itself not rebooted, so I would expect all the
> processes to be using the new executables rather than an older/deleted one. (I
> am a little loath to restart the service at the moment as I may well lose the
> info currently in '/proc/.../exe'.)
>
Did you upgrade xymon, or perhaps install it from a different 
maintainers RPM from the original one, or perhaps the original one 
wasn't an RPM install at all?

In these cases, the old running process in /proc/pid/exe is probably the 
original one, which the new install tried to restart / but because of a 
discrepancy in what is in /var/run it didn't quite work out as planned.

I think to truly understand this we might need more background 
information and a journal of what tasks were carried out.