SDS Posted December 14, 2004 Posted December 14, 2004 what the hell is that top process and why has it been there so long? How do I determine what it is and if it is bad - how do I kill it? last pid: 55970; load averages: 1.46, 1.44, 1.40 up 12+07:54:09 18:35:17 139 processes: 2 running, 137 sleeping CPU states: 30.2% user, 0.0% nice, 69.8% system, 0.0% interrupt, 0.0% idle Mem: 307M Active, 668M Inact, 264M Wired, 776K Cache, 199M Buf, 761M Free Swap: 1020M Total, 23M Used, 996M Free, 2% Inuse PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND 22744 www 61 0 58920K 12364K RUN 127:49 77.83% 77.83% httpd 25992 mysql 2 0 152M 86736K poll 154:25 7.42% 7.42% mysqld 22820 www 2 0 59076K 11648K accept 0:31 0.88% 0.88% httpd 22755 www 2 0 59192K 13120K accept 0:34 0.78% 0.78% httpd 22801 www 2 0 59064K 12516K accept 0:30 0.78% 0.78% httpd 22778 www 2 0 59068K 11528K accept 0:29 0.73% 0.73% httpd 22812 www 2 0 59136K 11592K accept 0:34 0.59% 0.59% httpd 22757 www 2 0 59116K 13176K accept 0:33 0.59% 0.59% httpd 22752 www 2 0 59096K 13276K accept 0:30 0.59% 0.59% httpd 22760 www 2 0 59104K 12568K accept 0:29 0.44% 0.44% httpd 22797 www 2 0 59072K 14372K accept 0:33 0.29% 0.29% httpd 22763 www 2 0 59072K 11808K accept 0:31 0.20% 0.20% httpd
Fezmid Posted December 14, 2004 Posted December 14, 2004 It's probably just an apache process. Could be a runaway, you could try bouncing apache (apachectl restart). Alternatively, make sure that it really is just that: $ ps -axj | grep http (returns output similar to:) root 11047 1 11047 e7b37090 0 Is ?? 0:02.51 httpd: parent (httpd) www 3955 11047 11047 e7b37090 0 I ?? 0:01.21 httpd: child (httpd) www 12299 11047 11047 e7b37090 0 I ?? 0:01.39 httpd: child (httpd) www 13025 11047 11047 e7b37090 0 I ?? 0:00.61 httpd: child (httpd) www 19646 11047 11047 e7b37090 0 I ?? 0:02.12 httpd: child (httpd) www 1752 11047 11047 e7b37090 0 I ?? 0:01.57 httpd: child (httpd) www 24425 11047 11047 e7b37090 0 I ?? 0:01.06 httpd: child (httpd) www 4362 11047 11047 e7b37090 0 I ?? 0:01.14 httpd: child (httpd) www 3451 11047 11047 e7b37090 0 I ?? 0:01.61 httpd: child (httpd) www 18769 11047 11047 e7b37090 0 I ?? 0:00.88 httpd: child (httpd) www 15917 11047 11047 e7b37090 0 I ?? 0:02.62 httpd: child (httpd) or: $ ps -axj | grep 22744 If the parent process is the same as the root owned process (11047 in my case), then it's just a thread. CW
Tux of Borg Posted December 15, 2004 Posted December 15, 2004 Depending on how you have the server set up. You can sometimes do an strace and cat out the results to a file. If a process is getting hung up somewhere, that will tell you where.
Fezmid Posted December 15, 2004 Posted December 15, 2004 Depending on how you have the server set up. You can sometimes do an strace and cat out the results to a file. If a process is getting hung up somewhere, that will tell you where. 160511[/snapback] As clarification, it's systrace in BSD, truss on Solaris, and I can't remember what it is on Linux or HPUX because my brain's mush from a RAID problem I fought with the past 2 days. (interesting aside [probably to nobody but myself]; had a RAID-5 setup with 6 disks in the array. "Lost" two of them when someone unplugged them and plugged them back in, and was able to restore the array AND the filesystem with no data loss. Thank god, because the site hadn't bothered to actually take backups of roughly 250G of the 550G of data. Idiots...) CW
crackur Posted December 15, 2004 Posted December 15, 2004 this is the most uninteresting stuff I have ever seen
Fezmid Posted December 15, 2004 Posted December 15, 2004 this is the most uninteresting stuff I have ever seen 160546[/snapback] Without it, there'd be no web, no online shopping, no message boards, no online banking, no TVs (yes, most TVs nowadays actually run embedded Linux), etc. CW
mcjeff215 Posted December 15, 2004 Posted December 15, 2004 As clarification, it's systrace in BSD, truss on Solaris, and I can't remember what it is on Linux or HPUX because my brain's mush from a RAID problem I fought with the past 2 days. (interesting aside [probably to nobody but myself]; had a RAID-5 setup with 6 disks in the array. "Lost" two of them when someone unplugged them and plugged them back in, and was able to restore the array AND the filesystem with no data loss. Thank god, because the site hadn't bothered to actually take backups of roughly 250G of the 550G of data. Idiots...) CW 160522[/snapback] strace on linux, but the command of the same name on Solaris and HPUX is "streams" trace, which are a sysVism.. not to be confused with file io streams, which are actually implemented as streams... It's truss on HPUX, too. I hate computers. I think I'll go back to school and be a park ranger.
mead107 Posted December 15, 2004 Posted December 15, 2004 the brains have to figure this out . i just a moron
mcjeff215 Posted December 15, 2004 Posted December 15, 2004 this is the most uninteresting stuff I have ever seen 160546[/snapback] Yeah, same here and I do it for a living. Actually, I don't do this exactly per se, I do architecture design. I need to stop being so cynical. It actually is quite interesting if you're in a good company. -Jeff
crackur Posted December 15, 2004 Posted December 15, 2004 Without it, there'd be no web, no online shopping, no message boards, no online banking, no TVs (yes, most TVs nowadays actually run embedded Linux), etc. CW 160547[/snapback] lol I know just like classes at college.......u have to havem .....but it still is uninteresting
Fezmid Posted December 15, 2004 Posted December 15, 2004 strace on linux, but the command of the same name on Solaris and HPUX is "streams" trace, which are a sysVism.. not to be confused with file io streams, which are actually implemented as streams... It's truss on HPUX, too. I hate computers. I think I'll go back to school and be a park ranger. 160548[/snapback] But wouldn't truss (on Solaris) be a better fit? From the man page, "truss - trace system calls and signals." strace doesn't look like what you want there, as it only checks streams. I messed up on the BSD equiv -- it's really ktrace and kdump. Not sure I want to be a park ranger after what happened in northern WI befoer Thanksgiving (Hmong guy hunted down and shot 6-8 people because they told him to get out of thei tree stand... Lovely). The ranger caught him, but only because the guy ran out of bullets. Lucky guy. I love my job (sysadmin/architect - used to be an Oracle DBA as well, as well as an EMC/EVA storage architect/admin, but that's been scaled down to mainly Linux/Solaris/HPUX admin/architect/design). I really want to start doing computer security, but the way things are going at my company, I'd need to go somewhere else as we don't focus on it very much yet CW
SDS Posted December 15, 2004 Author Posted December 15, 2004 I killed it. It was taking up to 90% of the cpu. this is bad if apache doesn't kill it off. something must be wrong....
mcjeff215 Posted December 15, 2004 Posted December 15, 2004 what the hell is that top process and why has it been there so long? How do I determine what it is and if it is bad - how do I kill it? last pid: 55970; load averages: 1.46, 1.44, 1.40 up 12+07:54:09 18:35:17 139 processes: 2 running, 137 sleeping CPU states: 30.2% user, 0.0% nice, 69.8% system, 0.0% interrupt, 0.0% idle Mem: 307M Active, 668M Inact, 264M Wired, 776K Cache, 199M Buf, 761M Free Swap: 1020M Total, 23M Used, 996M Free, 2% Inuse PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND 22744 www 61 0 58920K 12364K RUN 127:49 77.83% 77.83% httpd 25992 mysql 2 0 152M 86736K poll 154:25 7.42% 7.42% mysqld 22820 www 2 0 59076K 11648K accept 0:31 0.88% 0.88% httpd 22755 www 2 0 59192K 13120K accept 0:34 0.78% 0.78% httpd 22801 www 2 0 59064K 12516K accept 0:30 0.78% 0.78% httpd 22778 www 2 0 59068K 11528K accept 0:29 0.73% 0.73% httpd 22812 www 2 0 59136K 11592K accept 0:34 0.59% 0.59% httpd 22757 www 2 0 59116K 13176K accept 0:33 0.59% 0.59% httpd 22752 www 2 0 59096K 13276K accept 0:30 0.59% 0.59% httpd 22760 www 2 0 59104K 12568K accept 0:29 0.44% 0.44% httpd 22797 www 2 0 59072K 14372K accept 0:33 0.29% 0.29% httpd 22763 www 2 0 59072K 11808K accept 0:31 0.20% 0.20% httpd 160501[/snapback] If I had to guess (and I will), it's a PHP script. You're running mod_php, so PHP scripts are processed "in process" by the web server. You probably happened to run top while PHP was crunching something. Edit... I didn't notice the CPU time... I stand by the above statement, but perhaps the PHP code got stuck in a loop. -Jeff
Fezmid Posted December 15, 2004 Posted December 15, 2004 I killed it. It was taking up to 90% of the cpu. this is bad if apache doesn't kill it off. something must be wrong.... 160557[/snapback] I hope you didn't just kill it; restarting apache would've been the more graceful way to go. Not sure if Apache will be happy if one of its threads just up and died... Assuming, of course, that apache was the parent process. Oh well, whatever works. CW
mcjeff215 Posted December 15, 2004 Posted December 15, 2004 But wouldn't truss (on Solaris) be a better fit? From the man page, "truss - trace system calls and signals." strace doesn't look like what you want there, as it only checks streams. I messed up on the BSD equiv -- it's really ktrace and kdump. Not sure I want to be a park ranger after what happened in northern WI befoer Thanksgiving (Hmong guy hunted down and shot 6-8 people because they told him to get out of thei tree stand... Lovely). The ranger caught him, but only because the guy ran out of bullets. Lucky guy. I love my job (sysadmin/architect - used to be an Oracle DBA as well, as well as an EMC/EVA storage architect/admin, but that's been scaled down to mainly Linux/Solaris/HPUX admin/architect/design). I really want to start doing computer security, but the way things are going at my company, I'd need to go somewhere else as we don't focus on it very much yet CW 160556[/snapback] Nah, I like what I do, I just get fed up with all of the corporate red tape I need to wade through. You're right, strace isn't what you want on solaris.. you want truss... strace is a streams trace utility on HPUX and Solaris. I can't count how many times I've typed 'strace -p XX' and had one of those OS' complain at me.
cåblelady Posted December 15, 2004 Posted December 15, 2004 Oh well, whatever works. 160562[/snapback] Can I be a smart*ss now ?
mcjeff215 Posted December 15, 2004 Posted December 15, 2004 Can I be a smart*ss now ? 160566[/snapback] No not yet... hoooold.. iiittt.... not yet... hoooollldddd it... hoooolllddd it... ok, go 'head.
cåblelady Posted December 15, 2004 Posted December 15, 2004 No not yet... hoooold.. iiittt.... not yet... hoooollldddd it... hoooolllddd it... ok, go 'head. 160570[/snapback] Well......it's......the.......bunnies.......I tell ya.
TSNBDSC Posted December 15, 2004 Posted December 15, 2004 what the hell is that top process and why has it been there so long? How do I determine what it is and if it is bad - how do I kill it? last pid: 55970; load averages: 1.46, 1.44, 1.40 up 12+07:54:09 18:35:17 139 processes: 2 running, 137 sleeping CPU states: 30.2% user, 0.0% nice, 69.8% system, 0.0% interrupt, 0.0% idle Mem: 307M Active, 668M Inact, 264M Wired, 776K Cache, 199M Buf, 761M Free Swap: 1020M Total, 23M Used, 996M Free, 2% Inuse PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND 22744 www 61 0 58920K 12364K RUN 127:49 77.83% 77.83% httpd 25992 mysql 2 0 152M 86736K poll 154:25 7.42% 7.42% mysqld 22820 www 2 0 59076K 11648K accept 0:31 0.88% 0.88% httpd 22755 www 2 0 59192K 13120K accept 0:34 0.78% 0.78% httpd 22801 www 2 0 59064K 12516K accept 0:30 0.78% 0.78% httpd 22778 www 2 0 59068K 11528K accept 0:29 0.73% 0.73% httpd 22812 www 2 0 59136K 11592K accept 0:34 0.59% 0.59% httpd 22757 www 2 0 59116K 13176K accept 0:33 0.59% 0.59% httpd 22752 www 2 0 59096K 13276K accept 0:30 0.59% 0.59% httpd 22760 www 2 0 59104K 12568K accept 0:29 0.44% 0.44% httpd 22797 www 2 0 59072K 14372K accept 0:33 0.29% 0.29% httpd 22763 www 2 0 59072K 11808K accept 0:31 0.20% 0.20% httpd 160501[/snapback] ... ??? ... you computer guys are too much !!! ...
Recommended Posts