Hi Peter, If the defunct process dies off, then it is working as expected. Basically, the maild process forks every time it sends an e-mail and checks after a few minutes if the child process finished sending it. During this time, the child process can become defunct while waiting for the parent to finish it...
Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Nov 29, 2007 9:54 AM, Peter M. Abraham <[EMAIL PROTECTED]> wrote: > > Greetings: > > Yesterday I installed ossec v1.4 on a two CentOS 5 64-bit servers in a > server / agent configuration. > > This morning the client reported noticing defunct and zombie processes > on the ossec server side. > > ## QUOTE START > I was logging into the server to do a few things when I noticed this: > > ossecm 29407 0.0 0.0 0 0 ? Z 08:29 0:00 > [ossec-maild] <defunct> > > I'm getting notifications (as far as I know -- I've received several > over the past day). Is this something to be concerned about? > > It seems to only happen when an event triggers an email notification > (in this case, me logging in for the first time since OSSEC install). > > After a few minutes, the zombie process dies off and everything > seems to return to normal. > > ## QUOTE EOF > > Please let me know if I should post a bug report on http://www.ossec.net/bugs/ > or if this is something that can be fixed in short order. > > Please let me know if there are any questions in terms of helping to > solve or better understand this issue. > > Thank you. >
