X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:date:message-id:references
	:mime-version:content-type:content-transfer-encoding; q=dns; s=
	default; b=J4mBDpNE9/eN1IXrGa+0mT4V7C3r5HA7nYwlseEGQVbnWPu+x0vep
	93GLykWKu0PmCypjNBMrclCbBppLwEtC1Q3EoQ92j0zrRW+G/jgs47isp2rDqNPR
	fO3Di5ZF+OAVvtpEPUy+S9Pj5uXYHx6JlLI+JWmJt4E2g3pkvAAW5I=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:date:message-id:references
	:mime-version:content-type:content-transfer-encoding; s=default;
	 bh=yln3ihMzDufPqPeJf+WQG358FAU=; b=Xoc0j4BrHlky+4HQS4eijVUOo0HE
	WkRODZTOowJZE2/CDgYUAfD3KcoPjWYx5LEVp+TEVRE83UOP8VvJ/U1O/8uM7LK6
	63qB3AcO1GDNBKLb5JBkEFGMrvou1dOoDf3g7gpe8IblfTCK2GfxBiqqaJo1nuEe
	A8COsqKps45yMaE=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-0.2 required=5.0 tests=AWL,BASE64_LENGTH_79_INF,BAYES_50,MIME_BASE64_BLANKS,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS,SPF_PASS,T_RP_MATCHES_RCVD autolearn=no version=3.3.2
X-HELO: plane.gmane.org
To: cygwin AT cygwin DOT com
From: Mark Geisert <mark AT maxrnd DOT com>
Subject: Re: sshd PID changed
Date: Wed, 11 Mar 2015 19:52:31 +0000 (UTC)
Lines: 1
Message-ID: <loom.20150311T204216-575@post.gmane.org>
References: <CAO2ddnYogbgan+u7a_R23tBG_oVLgN0Yhxz6WAG5XkNjv1i9MA AT mail DOT gmail DOT com> <CAO2ddnYDX7EjCR_0VyZivW-nJwQHxLaLsvR5wFzBBSYOsk6TMQ AT mail DOT gmail DOT com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
User-Agent: Loom/3.14 (http://gmane.org/)
X-IsSubscribed: yes
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by delorie.com id t2BJqvrK011891

Kizito Porta Balanyà writes:
> No one is interested in this commented behaviour ?
> Or it is expected as designed ?
> 
> Thanks a lot for your time.
> 
> 2015-03-10 10:16 GMT+01:00 Kizito Porta Balanyà:
> > I'm receiving some rare monit messages related to the sshd service.
> >
> > The service "cygrunsrv sshd" is not restarted (eventviewer is OK), but
> > sometimes (not always) I get the following alerts:
> >
> >
> > Alert 1:
> > PID changed Service checkMatching_sshd
> >                  Date:        Mon, 09 Mar 2015 16:14:26
> >                  Description: process PID changed from 1968 to 1744
> >
> > PPID changed Service checkMatching_sshd
> >                  Date:        Mon, 09 Mar 2015 16:14:26
> >                  Description: process PPID changed from 5344 to 2860

Are those Windows pids or Cygwin pids?  Was monit built under Cygwin?

Windows processes don't (and can't) change their own pid.  Cygwin processes
don't have a need to do it and I don't know if it's even possible (by
mucking around in the shared data segment).  I feel unclean even suggesting
it might be possible.

What's likely happening is monit is reporting two separate sshd processes as
if it's talking about the same process.  When you login via sshd, another
sshd process is created for your session.

Or perhaps monit is malfunctionally not checking the process startup times
in addition to the process pids to distinguish between them.
HTH,

..mark