DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:date:message-id:references
	:mime-version:content-type:content-transfer-encoding; q=dns; s=
	default; b=J4mBDpNE9/eN1IXrGa+0mT4V7C3r5HA7nYwlseEGQVbnWPu+x0vep
	93GLykWKu0PmCypjNBMrclCbBppLwEtC1Q3EoQ92j0zrRW+G/jgs47isp2rDqNPR
	fO3Di5ZF+OAVvtpEPUy+S9Pj5uXYHx6JlLI+JWmJt4E2g3pkvAAW5I=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
To: cygwin@cygwin.com
From: Mark Geisert <mark@maxrnd.com>
Subject: Re: sshd PID changed
Date: Wed, 11 Mar 2015 19:52:31 +0000 (UTC)
Lines: 1
Message-ID: <loom.20150311T204216-575@post.gmane.org>
References: <CAO2ddnYogbgan+u7a_R23tBG_oVLgN0Yhxz6WAG5XkNjv1i9MA@mail.gmail.com> <CAO2ddnYDX7EjCR_0VyZivW-nJwQHxLaLsvR5wFzBBSYOsk6TMQ@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
User-Agent: Loom/3.14 (http://gmane.org/)
Content-Transfer-Encoding: 8bit

Kizito Porta Balanyà writes:
> No one is interested in this commented behaviour ?
> Or it is expected as designed ?
> 
> Thanks a lot for your time.
> 
> 2015-03-10 10:16 GMT+01:00 Kizito Porta Balanyà:
> > I'm receiving some rare monit messages related to the sshd service.
> >
> > The service "cygrunsrv sshd" is not restarted (eventviewer is OK), but
> > sometimes (not always) I get the following alerts:
> >
> >
> > Alert 1:
> > PID changed Service checkMatching_sshd
> >                  Date:        Mon, 09 Mar 2015 16:14:26
> >                  Description: process PID changed from 1968 to 1744
> >
> > PPID changed Service checkMatching_sshd
> >                  Date:        Mon, 09 Mar 2015 16:14:26
> >                  Description: process PPID changed from 5344 to 2860

Are those Windows pids or Cygwin pids?  Was monit built under Cygwin?

Windows processes don't (and can't) change their own pid.  Cygwin processes
don't have a need to do it and I don't know if it's even possible (by
mucking around in the shared data segment).  I feel unclean even suggesting
it might be possible.

What's likely happening is monit is reporting two separate sshd processes as
if it's talking about the same process.  When you login via sshd, another
sshd process is created for your session.

Or perhaps monit is malfunctionally not checking the process startup times
in addition to the process pids to distinguish between them.
HTH,

..mark