[ZBX-17880] proc.num fails with long process IDs Created: 2020 Jun 05  Updated: 2024 Apr 10  Resolved: 2020 Jun 11

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G)
Affects Version/s: 5.0.1
Fix Version/s: 5.2 (plan)

Type: Problem report Priority: Trivial
Reporter: Stephan A. Klein Assignee: Artjoms Rimdjonoks
Resolution: Won't fix Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Ubuntu 18.04 / Ubuntu 20.04

Team: Team C
Sprint: Sprint 65 (Jun 2020)
Story Points: 0.5

 Description   

Steps to reproduce

proc.num seems to have an issue with long process IDs on the latest Ubuntu LTS Release.

 

On Ubuntu 18.04 the check gives the correct result:

# zabbix_agentd -t proc.num[fail2ban-server]
proc.num[fail2ban-server] [u|1]
# ps wax |grep fail2ban
590 ? Ssl 207:44 /usr/bin/python3 /usr/bin/fail2ban-server -xf start

 

Same check on Ubuntu 20.04 gives:

zabbix_agentd -t proc.num[fail2ban-server]
proc.num[fail2ban-server] [u|0]
# ps wax |grep fail2ban
3446386 ? Ssl 93:28 /usr/bin/python3 /usr/bin/fail2ban-server -xf start

Root cause seems to be a change in /proc/sys/kernel/pid_max:

On Ubuntu 18.04 it's 32768, in Ubuntu 20.04 it's 4194304. Looks like Zabbix Agent has an issue with bigger PIDs.

 Comments   
Comment by Artjoms Rimdjonoks [ 2020 Jun 08 ]

This issue is caused by fail2ban-server changing its process name in Ubuntu 20.
Ubuntu 18:
systemctl status fail2ban
● fail2ban.service - Fail2Ban Service
Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2020-06-05 14:48:38 UTC; 2 days ago
Docs: man:fail2ban(1)
Main PID: 11095 (fail2ban-server)

Ubuntu 20:
systemctl status fail2ban
● fail2ban.service - Fail2Ban Service
Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2020-06-05 14:47:51 UTC; 2 days ago
Docs: man:fail2ban(1)
Main PID: 73645 (f2b/server)

ps wax command shows the command name that was used to launch the process and it stayed the same, however the process name itself changed. You can find the name of the process using ps by finding the process id first:

ps wax | grep fail2ban-server
    PID TTY      STAT   TIME COMMAND
  73645 ?        Ssl    0:19 /usr/bin/python3 /usr/bin/fail2ban-server -xf start

And then use it to find the process name:

ps -p 73645
    PID TTY          TIME    CMD
  73645 ?        00:00:19 f2b/server

Confusingly, COMMAND and CMD are different things from the point of view of the ps.

So, I suggest to use:

f2b/server

to count the number of fail2ban-server processes. It seems to be a common issue for other users around the internet (like firewalls not working) due to this fail2ban-server process name update.

Generated at Sun May 04 06:19:32 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.