The <defunct> is a child process stub trying to deliver the exit code and status to the parent wait() that has not been called to process SIGCHILD or whatever. It points to some programming error in the parent, that it ignores it's dead children. Wow, wiki:
Zombie process - Wikipedia, the free encyclopedia However,
Can't kill 'defunct' process - Toolbox for IT Groups says that dtlogin may have inherited the zombies from a crashed parent, so it may be another victim. Perhaps periodic reboots are a good idea?
Also, being a many time burnt veteran, I scan my systems for core files, which users, even developers, may not realize are left behind, indicating some vulnerability in the code. Less core generation is a really nice thing. I used file to find 14 bytes of the executable name, and gdb to do a stack trace, then compressed the core in /tmp (which we periodically clean of old files) and mailed all the info to the group. Removing it allows new core files from different users in the same place, without losing any interesting old core files. Sometimes it takes a while to find the bug, or learn to avoid it!
04-26-2011
