在SAP的系统上，通过ipcs检测到共享内存段状态，发现有一个与众不同的地方，那就是SAP的主共享内存段状态为D - Delete，这在通常情况下是不正常的。

    这里显示的内存段占用了大量的内存空间：

    r5p[/]#ipcs -am

    IPC status from /dev/kmem as of Mon Jan 31 09:40:03 2011

    T         ID     KEY        MODE        OWNER     GROUP   CREATOR    CGROUP NATTCH      SEGSZ  CPID  LPID   ATIME    DTIME    CTIME

    Shared Memory:

    m      65552 0x00000000 D-rw-rw-rw-    rpeadm    sapsys    rpeadm    sapsys     33 12582912000  4213  4213 13:12:12 no-entry 13:12:12

    通过shminfo检测，可以看到有大量SAP的进程注册在这个共享内存段，与共享内存存在交互：

    r5p[/]#shminfo -s 65552

    tool: shminfo 3.26

    unix: /stand/vmunix 11.23 64bit IA64 on "r5p"

    core: /dev/kmem live

    link: Wed Aug 02 12:02:35 PDT 2006

    boot: Fri Jan 28 13:06:46 2011

    time: Mon Jan 31 09:41:30 2011

    Shmid 65552:

    Descriptor : struct shmid_ds 0xe00000015b370680

    Pseudo vas : vas_t  0xe0000001849a94c0

    Pseudo preg: preg_t 0xe0000001849a2540

    Shared reg : reg_t  0xe00000018499e400

    Segment at 0x3bfc0031.0xc000000200000000

    Segment allocated out of "Global 64-bit quadrant 6"

    Processes using this segment:

    proc=0xe0000001826a4000 (pid 24654 "disp+work"): vas=0xe000000184b20700, shmem preg=0xe00000018787b4c0

    proc=0xe0000001826ae000 (pid 24425 "disp+work"): vas=0xe00000018663e040, shmem preg=0xe000000186643e80

    proc=0xe0000001826a6000 (pid 21509 "disp+work"): vas=0xe00000018783a700, shmem preg=0xe00000018795e400

    proc=0xe000000182222000 (pid 20106 "disp+work"): vas=0xe000000184d54280, shmem preg=0xe00000018ca88280

    proc=0xe000000181eb4000 (pid 19405 "disp+work"): vas=0xe0000001849a0dc0, shmem preg=0xe000000184b3f100

    proc=0xe0000001826aa000 (pid 15833 "disp+work"): vas=0xe000000184988280, shmem preg=0xe000000156616cc0

    proc=0xe000000182244000 (pid 13882 "disp+work"): vas=0xe0000001849a4b80, shmem preg=0xe00000018cb13e40

    proc=0xe0000001826b8000 (pid 4285 "disp+work"): vas=0xe00000018663e940, shmem preg=0xe0000001867857c0

    proc=0xe0000001826b4000 (pid 4283 "disp+work"): vas=0xe00000018663e700, shmem preg=0xe00000018673fcc0

    proc=0xe0000001826b2000 (pid 4282 "disp+work"): vas=0xe00000018663e4c0, shmem preg=0xe0000001866f9dc0

    proc=0xe0000001826b0000 (pid 4281 "disp+work"): vas=0xe00000018663e280, shmem preg=0xe0000001866b71c0

    proc=0xe00000018269e000 (pid 4272 "disp+work"): vas=0xe0000001864a1040, shmem preg=0xe0000001864d9b00

    proc=0xe0000001826a0000 (pid 4270 "disp+work"): vas=0xe000000186247dc0, shmem preg=0xe00000018649d940

    proc=0xe00000018269c000 (pid 4268 "disp+work"): vas=0xe000000186247b80, shmem preg=0xe000000186434a00

    proc=0xe000000182692000 (pid 4267 "disp+work"): vas=0xe000000186247940, shmem preg=0xe0000001863ef840

    proc=0xe000000182698000 (pid 4264 "disp+work"): vas=0xe000000186247700, shmem preg=0xe00000018639e800

    proc=0xe000000182696000 (pid 4263 "disp+work"): vas=0xe0000001862474c0, shmem preg=0xe000000186353880

    proc=0xe000000182690000 (pid 4260 "disp+work"): vas=0xe000000186247280, shmem preg=0xe000000186310980

    proc=0xe00000018223a000 (pid 4259 "disp+work"): vas=0xe00000018544db80, shmem preg=0xe0000001862a87c0

    proc=0xe00000018223e000 (pid 4258 "disp+work"): vas=0xe000000186247040, shmem preg=0xe000000186267880

    proc=0xe000000182238000 (pid 4255 "disp+work"): vas=0xe00000018544d940, shmem preg=0xe000000186214980

    proc=0xe000000182518000 (pid 4254 "disp+work"): vas=0xe000000184994dc0, shmem preg=0xe0000001861c96c0

    proc=0xe000000182514000 (pid 4238 "disp+work"): vas=0xe000000184999dc0, shmem preg=0xe000000184cf6c40

    proc=0xe000000182512000 (pid 4235 "disp+work"): vas=0xe0000001849a0040, shmem preg=0xe000000184ca1b80

    proc=0xe000000181ebe000 (pid 4234 "disp+work"): vas=0xe0000001849a0280, shmem preg=0xe000000184c649c0

    proc=0xe000000181ebc000 (pid 4231 "disp+work"): vas=0xe0000001849a0700, shmem preg=0xe000000184c22680

    proc=0xe000000181eb6000 (pid 4230 "disp+work"): vas=0xe0000001849a0940, shmem preg=0xe000000184be44c0

    proc=0xe000000181eb8000 (pid 4228 "disp+work"): vas=0xe0000001849a0b80, shmem preg=0xe000000184baa700

    proc=0xe000000181eb2000 (pid 4225 "disp+work"): vas=0xe0000001849a4040, shmem preg=0xe000000184b1c500

    proc=0xe0000001821fe000 (pid 4224 "disp+work"): vas=0xe0000001849a4280, shmem preg=0xe000000184adf640

    proc=0xe000000182228000 (pid 4221 "disp+work"): vas=0xe0000001849a44c0, shmem preg=0xe000000184aa1580

    proc=0xe0000001818be000 (pid 4220 "disp+work"): vas=0xe0000001849a4700, shmem preg=0xe000000184a66540

    proc=0xe00000015cf6a000 (pid 4213 "disp+work"): vas=0xe00000015722a700, shmem preg=0xe0000001849a2240

    第一次注意到这种情况，记录一下。

建议继续学习：

1. mysql 1045(28000)错误    (阅读：4637)
2. 文件明明存在但是file_exists总是返回FALSE    (阅读：3952)
3. Linux用户、用户组、文件权限学习笔记    (阅读：3655)
4. linux下如何自动提升权限    (阅读：3388)
5. crontab异常，无法自动运行    (阅读：3352)
6. (oracle)11g与10g中alter session权限差异    (阅读：3286)
7. ZooKeeper权限控制初探    (阅读：2897)
8. mysql的权限信息的存储    (阅读：2411)
9. Latch free竞争 - 最近的SAP测试项目小记    (阅读：2114)
10. IIS写权限利用续以及写权限漏洞来由解释    (阅读：2039)