| View previous topic :: View next topic |
| Author |
Message |
jesnow
l33t
Joined: 26 Apr 2006
Posts: 892
|
 Posted: Sun Jun 18, 2006 6:43 pm Post subject: Strange runaway root 'top' process |
 |
|
Every so often I find that something is grabbing 100% of my
processor cycles, with nothing else running. I have a very wimpy
system (VIA Nehemiah) and so this is very noticeable.
So, I do the obvious thing and su to root and fire up top. Lo and behold,
the bad guy is 'top' itself, owned by root! I kill it, and another pops up again
within seconds. After a few times around, all the instances of top owned by root
are dead except for the one I actusally launched myself.
What is going on? Have I been rooted?
Any help from the true gentoo cognoscenti would be appreciated.
Jon
Last edited by jesnow on Mon Apr 02, 2007 7:42 pm; edited 1 time in total |
|
| Back to top |
|
 |
xalan
Apprentice
Joined: 01 Feb 2005
Posts: 190
|
| Posted: Mon Jun 19, 2006 12:36 am Post subject: |
|
|
What is the process which is starting top? Is it the same one that *you* started it when logged as root? Is it possible for you to isolate it using process tree using pstree when the system suddenly slows down? emerge acct and use system accounting to see how long such weird processes are running.
To see if you are system is sane, atleast emerge rkhunter and see if there are any compromises. |
|
| Back to top |
|
|
jesnow
l33t
Joined: 26 Apr 2006
Posts: 892
|
| Posted: Mon Apr 02, 2007 7:41 pm Post subject: |
|
|
I have now confirmed this on a different machine, my work machine.
The mysterious root-top process appears after I have closed a window
in which top has been running as root. The root-top process then grabs 100%
of cpu cycles until it is killed.
Check out this output from top -b -n1:
| Code: |
top - 09:37:29 up 1:11, 1 user, load average: 0.54, 0.57, 0.61
Tasks: 94 total, 3 running, 91 sleeping, 0 stopped, 0 zombie
Cpu(s): 4.3%us, 3.7%sy, 0.4%ni, 86.5%id, 3.7%wa, 0.0%hi, 1.4%si, 0.0%st
Mem: 1034048k total, 931672k used, 102376k free, 76612k buffers
Swap: 506008k total, 0k used, 506008k free, 674596k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
22642 root 25 0 2176 1100 828 R 101 0.1 0:22.48 top
1 root 15 0 1536 536 464 S 0 0.1 0:00.86 init
2 root RT 0 0 0 0 S 0 0.0 0:00.02 migration/0
3 root 39 19 0 0 0 S 0 0.0 0:00.00 ksoftirqd/0
4 root RT 0 0 0 0 S 0 0.0 0:00.01 migration/1
5 root 34 19 0 0 0 R 0 0.0 0:00.00 ksoftirqd/1
6 root 10 -5 0 0 0 S 0 0.0 0:00.02 events/0
7 root 10 -5 0 0 0 S 0 0.0 0:00.01 events/1
8 root 10 -5 0 0 0 S 0 0.0 0:00.01 khelper
9 root 10 -5 0 0 0 S 0 0.0 0:00.00 kthread
|
This seems only to happen if I su to root, run top, then click the window
away (rather than 'q'-ing out from top and exiting the root shell).
Strange!
Is this a bug or a feature?
Jon |
|
| Back to top |
|
|
ksp7498
Apprentice
Joined: 08 Jun 2006
Posts: 225
Location: North Carolina - US
|
| Posted: Tue Apr 03, 2007 6:26 pm Post subject: |
|
|
I have seen this issue before as well. I don't think it's so much of a "bug" as it is an abuse of the program. In general it is not a good idea to just close an xterm that has a program running in it without actually stopping the program first. As you've seen, some programs don't take nicely to having their terminals ripped out from under them. In order to avoid issues like that I never "x" out an xterm, I always get rid of them by typing "exit".
_________________
“Isn’t it enough to see that a garden is beautiful without having to believe that there are fairies at the bottom of it too?”
– Douglas Adams |
|
| Back to top |
|
|
jesnow
l33t
Joined: 26 Apr 2006
Posts: 892
|
| Posted: Tue Apr 03, 2007 10:35 pm Post subject: |
|
|
| ksp7498 wrote: | | I have seen this issue before as well. I don't think it's so much of a "bug" as it is an abuse of the program. In general it is not a good idea to just close an xterm that has a program running in it without actually stopping the program first. As you've seen, some programs don't take nicely to having their terminals ripped out from under them. In order to avoid issues like that I never "x" out an xterm, I always get rid of them by typing "exit". |
Geez, I'm glad I'm not the only one.
That [X] in the upper right means I can click on it to end the session and anythng running in it. Meaning xterm, or in this kase, konsole 1.6.5 should send an appropriate kill signal to any child processes I forked (unless I nohupped them) and exit. Those child processes have the duty to die and not become cpu-hungry daemons. I'm not sure where in this chain of events something goes wrong with top.
Cheers,
Jon |
|
| Back to top |
|
|
jesnow
l33t
Joined: 26 Apr 2006
Posts: 892
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Kernel & Hardware
