Process check always running restart script

[Brian Youngstrom]

I'm having some problems with some of my hosts after upgrading to
v2.0.6.  All machines are Redhat 7.3 w/ local kernel.

In my input file, I have

    processes:
       "syslogd" restart "/etc/rc.d/init.d/syslog restart"
            useshell=false
            inform=true

        "ntpd" restart "/etc/init.d/ntpd restart"
            useshell=false
    
and so on.  This has worked perfectly on all machines up through v2.0.5.  After
upgrading, some of my machines are always running the restart script.

Snippets of cfagent -d2:
Actionsequence item processes
cfengine:frida: Running process command /bin/ps auxw
cfpopen(/bin/ps auxw)
Appending [USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME 
COMMAND]
Appending [root         1  0.0  0.0  1368  432 ?        S    Apr07   0:04 init]
Appending [root         2  0.0  0.0     0    0 ?        SW   Apr07   0:01 
[keventd]]
Appending [root         3  0.0  0.0     0    0 ?        SWN  Apr07   0:04 
[ksoftirqd_CPU0]]
[...]
Appending [root      3883  0.0  0.1  1656  652 ?        S    10:11   0:00 
syslogd -m 0]
Appending [root      3896  0.0  0.0  1364  440 ?        S    10:11   0:00 klogd 
-x]
Appending [root      4001  0.0  0.1  1468  544 ?        S    10:11   0:00 
/usr/sbin/smartd]
Appending [ntp       4541  0.0  0.3  1884 1876 ?        SL   10:15   0:00 
[ntpd]]
[...]
Regex root      4684  0.0  0.1  1656  652 ?        S    11:01   0:00 syslogd -m 
0 matched syslogd
ProcessFilter(root  ...)
Matched proc[root      4684  0.0  0.1  1656  652 ?        S    11:01   0:00 
syslogd -m 0]
Found matching pid 4684
Defining classes
DoSignals(syslogd)
cfengine:frida: Matches found for syslogd - no restart sequence
[...]
Regex ntp       4541  0.0  0.3  1884 1876 ?        SL   10:15   0:00 [ntpd] 
matched ntpd
ProcessFilter(ntp   ...)
Matched proc[ntp       4541  0.0  0.3  1884 1876 ?        SL   10:15   0:00 
[ntpd]]
Found matching pid 4541
Regex ntp       4719  0.0  0.3  1888 1880 ?        SL   11:01   0:00 [ntpd] 
matched ntpd
ProcessFilter(ntp   ...)
Matched proc[ntp       4719  0.0  0.3  1888 1880 ?        SL   11:01   0:00 
[ntpd]]
Found matching pid 4719
Defining classes
DoSignals(ntpd)
cfengine:frida: Matches found for ntpd - no restart sequence


so it looks like cfengine sees the processes there, recognizes that
nothing should happen, but runs the restart script anyway.

Any idea why this would be happening?

Thanks,
-Brian

-- 
Brian Youngstrom
byoung@cs.washington.edu
University of Washington
Computer Science & Engineering