running lsof on the server today I came across that mysqld was showing up as deleted. Does anyone came across something like this before, or there is an explanation about this. Is it a bug?

lsof | grep /usr/sbin/mysqld
mysqld     2589     mysql  txt       REG              253,1   12681241     312101 /usr/sbin/mysqld (deleted)
  • Is the MySQL executable really deleted on the filesystem? – Vladimir May 2 '18 at 12:07

Verify that in fact the mysqld binary is present on the filesystem:

ls -la /usr/sbin/mysqld

If it is there you probably upgraded mysql but did not restarted the daemon, hence the binary in memory was deleted and is now different from the one on the filesystem.

| improve this answer | |
  • It is there and the binary is there – Olive.b May 2 '18 at 13:40
  • It is the same on the filesystem – Olive.b May 2 '18 at 13:42

This leads me to believe that the mysql package was updated and mysqld was not restarted. The old binary was deleted and a new binary installed.

In Linux, deleting (unlinking) an open file does not really delete the contents of the file. A processes that held the file open before the unlink will still be able to access the file until it exits. When all processes close the unlinked file, the contents of the file become unreachable.

In this case, mysqld from the old version of the package is still running and /usr/sbin/mysqld is a link to the new version of the file.

Fun fact: You can actually get the original file back using cp:

cp /proc/2589/exe /tmp/mysqld

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.