Robert R. Henry

09/13/2022, 9:20 PM
What I believe to be a stock build and deb install on ubuntu 22.04 of the orbit and osqueryd has ~100 zombie sudo processes as children of the orbit process. I'm wondering what the cause of this is?


09/13/2022, 10:33 PM
Some basic Unix debugging… What, if any, info do you have about the process? Can you check sudo logs to see what it's running? Regardless, orbit is a #fleet project, and you should check there. Osquery does not exec or call sudo

Robert R. Henry

09/14/2022, 6:04 PM
all defunct(zombie) processes are labeled in pstree as "sudo". All defunct processes are children of orbit. defunct processes are created once every 45 seconds. Running as root strace -f -p $orbit_pid doesn't show any fork/execs in the syscall trace, but that could be an artifact of strace as root attached to a pid. The strace also doesn't show any wait systemcalls, just some successful epoll_wait. strace -f the osqueryd process shows it just plugging along gathering data. /var/log/orbit exists as an empty directory
6:05 PM
thanks for the help.