mysqld process deleted in lsof

Question

running lsof on the server today I came across that mysqld was showing up as deleted. Does anyone came across something like this before, or there is an explanation about this. Is it a bug?

lsof | grep /usr/sbin/mysqld
mysqld     2589     mysql  txt       REG              253,1   12681241     312101 /usr/sbin/mysqld (deleted)

Is the MySQL executable really deleted on the filesystem? – Vladimir May 02 '18 at 12:07 — Vladimir, May 02 '18 at 12:07

score 1 · Answer 1 · answered May 02 '18 at 12:15

1

Verify that in fact the mysqld binary is present on the filesystem:

ls -la /usr/sbin/mysqld

If it is there you probably upgraded mysql but did not restarted the daemon, hence the binary in memory was deleted and is now different from the one on the filesystem.

answered May 02 '18 at 12:15

Daniel

302
1
5

It is there and the binary is there – Olive.b May 02 '18 at 13:40
It is the same on the filesystem – Olive.b May 02 '18 at 13:42

Mario · Answer 2 · 2018-05-02T14:58:56.510

This leads me to believe that the mysql package was updated and mysqld was not restarted. The old binary was deleted and a new binary installed.

In Linux, deleting (unlinking) an open file does not really delete the contents of the file. A processes that held the file open before the unlink will still be able to access the file until it exits. When all processes close the unlinked file, the contents of the file become unreachable.

In this case, mysqld from the old version of the package is still running and /usr/sbin/mysqld is a link to the new version of the file.

Fun fact: You can actually get the original file back using cp:

cp /proc/2589/exe /tmp/mysqld

mysqld process deleted in lsof

2 Answers2