Posted Mar 31, 2011 14:21 UTC (Thu) by cesarb (subscriber, #6266)
Parent article: Fighting fork bombs
> Keeping the entire history of all processes created over the lifetime of a Linux system would be a costly endeavor. Clearly, there comes a point where history needs to be discarded.
I am failing to see why. You only need to keep the family tree of live processes (thus, branches with only dead leaves can be pruned). You do not need to keep all the inner nodes too; if you have a dead inner node with a single dead children, you can collapse both into a single dead inner node (how many intermediate dead nodes you had does not matter, and even if it did they could be replaced by a counter in the collapsed node). Unless I am visualizing it incorrectly, the worst case then is a binary tree with all the live nodes being the leaves, and so it has a bounded size (which is not that large).