Re: sshd PID changed

[Mark Geisert <mark at maxrnd dot com>]

Kizito Porta Balanyà writes:
> No one is interested in this commented behaviour ?
> Or it is expected as designed ?
> 
> Thanks a lot for your time.
> 
> 2015-03-10 10:16 GMT+01:00 Kizito Porta BalanyÃ:
> > I'm receiving some rare monit messages related to the sshd service.
> >
> > The service "cygrunsrv sshd" is not restarted (eventviewer is OK), but
> > sometimes (not always) I get the following alerts:
> >
> >
> > Alert 1:
> > PID changed Service checkMatching_sshd
> >                  Date:        Mon, 09 Mar 2015 16:14:26
> >                  Description: process PID changed from 1968 to 1744
> >
> > PPID changed Service checkMatching_sshd
> >                  Date:        Mon, 09 Mar 2015 16:14:26
> >                  Description: process PPID changed from 5344 to 2860

Are those Windows pids or Cygwin pids?  Was monit built under Cygwin?

Windows processes don't (and can't) change their own pid.  Cygwin processes
don't have a need to do it and I don't know if it's even possible (by
mucking around in the shared data segment).  I feel unclean even suggesting
it might be possible.

What's likely happening is monit is reporting two separate sshd processes as
if it's talking about the same process.  When you login via sshd, another
sshd process is created for your session.

Or perhaps monit is malfunctionally not checking the process startup times
in addition to the process pids to distinguish between them.
HTH,

..mark