On 22.07.2022 00:52, Moby wrote:
Thanks Robert.
The PIDs reported by zypper ps change after each reboot. I rebooted the machine again and ran zypper ps --debugFile zypper-dbg1
zypper ps output on the screen shows PID of 1270 for sshd using /usr/lib64/libaudit.so.1.0.0 (path dev=0,35). That file is not deleted.
grep'ing zypper-dbg1 for 1270, and then looking for the line containing libaudit.so.1.0.0 shows:
fmem^@tREG^@n/usr/lib64/libaudit.so.1.0.0 (path dev=0,35)^@
See the LSOF FAQ (https://github.com/lsof-org/lsof/blob/bcc125b7c2a160da019dd8089b999bc6d34866...): 10.4.1 What do ``path dev=xxx'' and ``path inode=yyy'' mean in the NAME column of Linux ``mem'' file types? ... When device and inode mismatches occur, lsof suppresses the reporting of link count and size. ... and the lack of link count is interpreted by zypper as indication that file was deleted. Show full output of lsof -p 1270 cat /proc/1270/maps stat /usr/lib64/libaudit.so.1.0.0 cat /proc/self/mountinfo cat /proc/1270/mountinfo