[cobalt-users] grep command gets "stuck"

["Joseph Lundgren" <josephl@xxxxxxxxxxxx>]

Greetings,

Recently, one of our Cobalt RaQ 4r (512MB RAM) (Linux xxx.xxx.com
2.2.16C32_III #1 Fri Nov 9 21:54:54 PST 2001 i586 unknown) has started to
malfunction.  We have all applicable patches installed.

I first noticed the malfunction when the front LCD panel got "stuck"
displaying  SETTING UP WEB SERVER... (or some such message)  and wouldn't
respond to pressing and holding the  S  key on the front.

I SSH'ed into the machine and found the following errant processes (using
ps -auxfww) (I modified the output so that it will display nested properly.
Basically, I cropped out everything before the thread status, none of
which is out of the ordinary, ie... no processes consuming more than 0.1
percent of memory or cpu load)

S    Jun13   0:00 crond
S    Jun16   0:00  \_ CROND
S    Jun16   0:00  |   \_ bash /usr/bin/run-parts /etc/cron.hourly
S    Jun16   0:00  |       \_ sh /etc/cron.hourly/asp_monitor.sh
T    Jun16   0:00  |           \_ grep :on
Z    Jun16   0:00  |               \_ [grep <defunct>]
S    09:01   0:00  \_ CROND
S    09:01   0:00      \_ bash /usr/bin/run-parts /etc/cron.hourly
S    09:01   0:00          \_ sh /etc/cron.hourly/asp_monitor.sh
S    09:01   0:00              \_ sh /home/chiliasp/asp-apache-3000/caspctrl
status
S    09:01   0:00              \_ sh /home/chiliasp/asp-apache-3000/caspctrl
status
T    09:01   0:00                  \_
egrep(/home/chiliasp/chilicom/bin:/home/chiliasp/chilicom/bin/linux2_debug|/
home/chiliasp/chilicom/bin:/home/chiliasp/chilicom/bin/linux2_optimized)
Z    09:01   0:00                      \_ [egrep <defunct>]

S    Jun13   0:01 /sbin/lcdsleep
S    09:32   0:00  \_ sh /etc/rc.d/init.d/lcd-showip
S    09:32   0:00      \_ sh /etc/rc.d/init.d/lcd-showip
T    09:32   0:00          \_ hostname
Z    09:32   0:00              \_ [hostname <defunct>]

S    04:15   0:00 sendmail: q2/g5HBExA29589: from queue
T    04:15   0:00  \_ procmail -f ping7850@xxxxxxxxxxxx -Y -a  -d helen
Z    04:15   0:00      \_ [procmail <defunct>]

What's going on here? Has my e/f/grep binary been damged?
When I locate the grep(s) I get the following:[admin admin]$ locate
grep|xargs ls -al
-rwxr-xr-x   1 root     root       120958 Jun 14  2000 /bin/egrep
-rwxr-xr-x   1 root     root       120958 Jun 14  2000 /bin/fgrep
-rwxr-xr-x   1 root     root       120957 Jun 14  2000 /bin/grep

On a similarly configured machine, when I locate the grep(s) I get the
following:
[root admin]# locate grep|xargs ls -al
-rwxr-xr-x   1 root     root       112199 Jun 14  2000 /bin/egrep
-rwxr-xr-x   1 root     root       112199 Jun 14  2000 /bin/fgrep
-rwxr-xr-x   1 root     root       112198 Jun 14  2000 /bin/grep

The binary sizes are different...

When I query the binary, I get the following:
[root admin]# /bin/grep --version
grep (GNU grep) 2.4
<snip>copyright, etc</snip>


Any ideas anyone?  Do you suppose the system has been compromised?  Should I
install grep 2.5 on the system?  Will other things break if I do this?



Thanks,

Joseph Lundgren
System Administrator
josephl@xxxxxxxxxxxx
Nu-World Communications
http://www.nu-world.com