On 05/08/2019 12:56, John Horne wrote: > Hello, > > I was looking at a process through the '/proc' file system, and came across a > process name which seemed to contain a hex value: > > lrwxrwxrwx. 1 xymon xymon 0 Aug 2 14:07 /proc/58032/exe -> > /usr/sbin/xymond;5d44410e (deleted) > > I am aware of what the 'deleted' part means, but have no idea what the > ';5d44410e' part means. Is this some sort of thread reference? > The file '/usr/sbin/xymond' does exist and is running as a daemon. > > Anyone know what the ';5d44410e' is referring to? I have tried Googling about > this, but found no mention of it. > > I am not absolutely sure, but is it saying that /usr/sbin/xymond was deleted, but was located at that inode reference on the disk? I know you say it exists, but perhaps it was deleted since running and then re-created? or perhaps it is an self-modifying executable?