Process Hacker and Windows discussion

 
frozenspider
Member
Posts: 4
OS: Windows 8.1 x64
Location: Uzbekistan

Parent process is sometimes not resolved

02 Jul 2017, 09:46

Windows 8.1 x64, Process Hacker 2.39.124 (latest at the moment)

The problem is illustrated in this screenshot:
http://pix.my/bvm82a
I have a bunch of processes started by explorer.exe, and while some of them (like Thunderbird in this example) are displayed as explorer's child with resolved parent, for many more (like Skype here) parent is resolved to be "Non-existent process". You can clearly see that PID matches. Besides, Skype was actually started by Explorer.

I might add that I recently reinstalled Windows (using same distr), and wasn't encountering this issue for many years of using PH before reinstall.
 
frozenspider
Member
Posts: 4
OS: Windows 8.1 x64
Location: Uzbekistan

Re: Parent process is sometimes not resolved

02 Jul 2017, 10:24

Restarting PH doesn't help
 
User avatar
dmex
Admin
Posts: 1282
Location: Australia

Re: Parent process is sometimes not resolved

02 Jul 2017, 10:27

frozenspider wrote:
02 Jul 2017, 09:46
You can clearly see that PID matches. Besides, Skype was actually started by Explorer.
Windows will re-use PIDs after processes' exit and the process parenting order is based on the parent PID and parent process start time. Explorer will also sometimes use a 'broker' process to launch programs and it's not unusual for the parent PID to mismatch since the original PID was re-used for a new process.

Your screenshot shows Thunderbird having been started "584 centuries ago" while Skype shows "22 minutes" so it's more than likely not showing the correct parent because of the current system time?
 
frozenspider
Member
Posts: 4
OS: Windows 8.1 x64
Location: Uzbekistan

Re: Parent process is sometimes not resolved

02 Jul 2017, 10:29

Indeed, I've recently changed system timezone and used Windows time sync service, so this probably is the case. Thanks!
 
User avatar
dmex
Admin
Posts: 1282
Location: Australia

Re: Parent process is sometimes not resolved

11 Jul 2017, 04:28

frozenspider wrote:
02 Jul 2017, 10:29
Indeed, I've recently changed system timezone and used Windows time sync service, so this probably is the case. Thanks!
The parenting should still work after changing the system time... After changing the timezone did you go forwards or backwards in time?
 
frozenspider
Member
Posts: 4
OS: Windows 8.1 x64
Location: Uzbekistan

Re: Parent process is sometimes not resolved

11 Jul 2017, 05:56

Can't recall exactly at the moment. What I am sure about though is that parentless processes (as well as explorer itself) were started before timezone change and time sync. Terminating the process and starting it again manually shows the correct parent for the newborn process.
Fortunately enough, I haven't rebooted since. Here's one process with this problem still persistent, which I haven't restarted. You can clearly see that its start time is shown as time earlier than that of its parent, which I imagine shouldn't be possible.
http://pix.my/93L87o
 
User avatar
dmex
Admin
Posts: 1282
Location: Australia

Re: Parent process is sometimes not resolved

11 Jul 2017, 06:59

frozenspider wrote:
11 Jul 2017, 05:56
What I am sure about though is that parentless processes (as well as explorer itself) were started before timezone change and time sync. Terminating the process and starting it again manually shows the correct parent for the newborn process.
I have an idea what's causing the problem but I'm not sure how it should be solved yet...
frozenspider wrote:
11 Jul 2017, 05:56
Fortunately enough, I haven't rebooted since. Here's one process with this problem still persistent, which I haven't restarted. You can clearly see that its start time is shown as time earlier than that of its parent, which I imagine shouldn't be possible.
http://pix.my/93L87o
I've updated the nightly build to v3.0.785 and changed how some values are converted to local time... can you update to the latest nightly build via the Help > Check for updates menu and let me know if the process parenting is now working and/or the process start time is now correct?
 
frozenspider
Member
Posts: 4
OS: Windows 8.1 x64
Location: Uzbekistan

Re: Parent process is sometimes not resolved

11 Jul 2017, 07:07

Checked with the nightly build you mentioned - no change: dates are the same, parent is not resolved.

Who is online

Users browsing this forum: No registered users and 3 guests