Jump to content

Help with server process!!!!


SDS

Recommended Posts

what the hell is that top process and why has it been there so long? How do I determine what it is and if it is bad - how do I kill it?

 

last pid: 55970; load averages: 1.46, 1.44, 1.40 up 12+07:54:09 18:35:17

139 processes: 2 running, 137 sleeping

CPU states: 30.2% user, 0.0% nice, 69.8% system, 0.0% interrupt, 0.0% idle

Mem: 307M Active, 668M Inact, 264M Wired, 776K Cache, 199M Buf, 761M Free

Swap: 1020M Total, 23M Used, 996M Free, 2% Inuse

 

PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND

22744 www 61 0 58920K 12364K RUN 127:49 77.83% 77.83% httpd

25992 mysql 2 0 152M 86736K poll 154:25 7.42% 7.42% mysqld

22820 www 2 0 59076K 11648K accept 0:31 0.88% 0.88% httpd

22755 www 2 0 59192K 13120K accept 0:34 0.78% 0.78% httpd

22801 www 2 0 59064K 12516K accept 0:30 0.78% 0.78% httpd

22778 www 2 0 59068K 11528K accept 0:29 0.73% 0.73% httpd

22812 www 2 0 59136K 11592K accept 0:34 0.59% 0.59% httpd

22757 www 2 0 59116K 13176K accept 0:33 0.59% 0.59% httpd

22752 www 2 0 59096K 13276K accept 0:30 0.59% 0.59% httpd

22760 www 2 0 59104K 12568K accept 0:29 0.44% 0.44% httpd

22797 www 2 0 59072K 14372K accept 0:33 0.29% 0.29% httpd

22763 www 2 0 59072K 11808K accept 0:31 0.20% 0.20% httpd

Link to comment
Share on other sites

It's probably just an apache process. Could be a runaway, you could try bouncing apache (apachectl restart). Alternatively, make sure that it really is just that:

 

$ ps -axj | grep http

(returns output similar to:)

root 11047 1 11047 e7b37090 0 Is ?? 0:02.51 httpd: parent (httpd)

www 3955 11047 11047 e7b37090 0 I ?? 0:01.21 httpd: child (httpd)

www 12299 11047 11047 e7b37090 0 I ?? 0:01.39 httpd: child (httpd)

www 13025 11047 11047 e7b37090 0 I ?? 0:00.61 httpd: child (httpd)

www 19646 11047 11047 e7b37090 0 I ?? 0:02.12 httpd: child (httpd)

www 1752 11047 11047 e7b37090 0 I ?? 0:01.57 httpd: child (httpd)

www 24425 11047 11047 e7b37090 0 I ?? 0:01.06 httpd: child (httpd)

www 4362 11047 11047 e7b37090 0 I ?? 0:01.14 httpd: child (httpd)

www 3451 11047 11047 e7b37090 0 I ?? 0:01.61 httpd: child (httpd)

www 18769 11047 11047 e7b37090 0 I ?? 0:00.88 httpd: child (httpd)

www 15917 11047 11047 e7b37090 0 I ?? 0:02.62 httpd: child (httpd)

 

or:

$ ps -axj | grep 22744

 

If the parent process is the same as the root owned process (11047 in my case), then it's just a thread.

CW

Link to comment
Share on other sites

Depending on how you have the server set up.  You can sometimes do an strace and cat out the results to a file.  If a process is getting hung up somewhere, that will tell you where.

160511[/snapback]

 

As clarification, it's systrace in BSD, truss on Solaris, and I can't remember what it is on Linux or HPUX because my brain's mush from a RAID problem I fought with the past 2 days. (interesting aside [probably to nobody but myself]; had a RAID-5 setup with 6 disks in the array. "Lost" two of them when someone unplugged them and plugged them back in, and was able to restore the array AND the filesystem with no data loss. Thank god, because the site hadn't bothered to actually take backups of roughly 250G of the 550G of data. Idiots...)

 

CW

Link to comment
Share on other sites

this is the most uninteresting stuff I have ever seen

160546[/snapback]

 

Without it, there'd be no web, no online shopping, no message boards, no online banking, no TVs (yes, most TVs nowadays actually run embedded Linux), etc. :P

 

CW

Link to comment
Share on other sites

As clarification, it's systrace in BSD, truss on Solaris, and I can't remember what it is on Linux or HPUX because my brain's mush from a RAID problem I fought with the past 2 days. (interesting aside [probably to nobody but myself]; had a RAID-5 setup with 6 disks in the array.  "Lost" two of them when someone unplugged them and plugged them back in, and was able to restore the array AND the filesystem with no data loss.  Thank god, because the site hadn't bothered to actually take backups of roughly 250G of the 550G of data.  Idiots...)

 

CW

160522[/snapback]

 

strace on linux, but the command of the same name on Solaris and HPUX is "streams" trace, which are a sysVism.. not to be confused with file io streams, which are actually implemented as streams...

 

It's truss on HPUX, too.

 

I hate computers. I think I'll go back to school and be a park ranger.

Link to comment
Share on other sites

this is the most uninteresting stuff I have ever seen

160546[/snapback]

 

Yeah, same here and I do it for a living. Actually, I don't do this exactly per se, I do architecture design.

 

I need to stop being so cynical. It actually is quite interesting if you're in a good company.

 

-Jeff

Link to comment
Share on other sites

Without it, there'd be no web, no online shopping, no message boards, no online banking, no TVs (yes, most TVs nowadays actually run embedded Linux), etc. :P

 

CW

160547[/snapback]

lol I know just like classes at college.......u have to havem .....but it still is uninteresting

Link to comment
Share on other sites

strace on linux, but the command of the same name on Solaris and HPUX is "streams" trace, which are a sysVism.. not to be confused with file io streams, which are actually implemented as streams...

 

It's truss on HPUX, too.

 

I hate computers.  I think I'll go back to school and be a park ranger.

160548[/snapback]

 

But wouldn't truss (on Solaris) be a better fit? From the man page, "truss - trace system calls and signals." strace doesn't look like what you want there, as it only checks streams.

 

I messed up on the BSD equiv -- it's really ktrace and kdump.

 

Not sure I want to be a park ranger after what happened in northern WI befoer Thanksgiving (Hmong guy hunted down and shot 6-8 people because they told him to get out of thei tree stand... Lovely). The ranger caught him, but only because the guy ran out of bullets. Lucky guy.

 

I love my job (sysadmin/architect - used to be an Oracle DBA as well, as well as an EMC/EVA storage architect/admin, but that's been scaled down to mainly Linux/Solaris/HPUX admin/architect/design). I really want to start doing computer security, but the way things are going at my company, I'd need to go somewhere else as we don't focus on it very much yet :P

CW

Link to comment
Share on other sites

what the hell is that top process and why has it been there so long?  How do I determine what it is and if it is bad - how do I kill it?

 

last pid: 55970;  load averages:  1.46,  1.44,  1.40  up 12+07:54:09  18:35:17

139 processes: 2 running, 137 sleeping

CPU states: 30.2% user,  0.0% nice, 69.8% system,  0.0% interrupt,  0.0% idle

Mem: 307M Active, 668M Inact, 264M Wired, 776K Cache, 199M Buf, 761M Free

Swap: 1020M Total, 23M Used, 996M Free, 2% Inuse

 

  PID USERNAME PRI NICE  SIZE    RES STATE    TIME   WCPU    CPU COMMAND

22744 www       61   0 58920K 12364K RUN    127:49 77.83% 77.83% httpd

25992 mysql      2   0   152M 86736K poll   154:25  7.42%  7.42% mysqld

22820 www        2   0 59076K 11648K accept   0:31  0.88%  0.88% httpd

22755 www        2   0 59192K 13120K accept   0:34  0.78%  0.78% httpd

22801 www        2   0 59064K 12516K accept   0:30  0.78%  0.78% httpd

22778 www        2   0 59068K 11528K accept   0:29  0.73%  0.73% httpd

22812 www        2   0 59136K 11592K accept   0:34  0.59%  0.59% httpd

22757 www        2   0 59116K 13176K accept   0:33  0.59%  0.59% httpd

22752 www        2   0 59096K 13276K accept   0:30  0.59%  0.59% httpd

22760 www        2   0 59104K 12568K accept   0:29  0.44%  0.44% httpd

22797 www        2   0 59072K 14372K accept   0:33  0.29%  0.29% httpd

22763 www        2   0 59072K 11808K accept   0:31  0.20%  0.20% httpd

160501[/snapback]

 

If I had to guess (and I will), it's a PHP script. You're running mod_php, so PHP scripts are processed "in process" by the web server. You probably happened to run top while PHP was crunching something.

 

Edit... I didn't notice the CPU time... I stand by the above statement, but perhaps the PHP code got stuck in a loop.

 

-Jeff

Link to comment
Share on other sites

I killed it.  It was taking up to 90% of the cpu.

 

this is bad if apache doesn't kill it off.  something must be wrong....

160557[/snapback]

 

I hope you didn't just kill it; restarting apache would've been the more graceful way to go. Not sure if Apache will be happy if one of its threads just up and died...

 

Assuming, of course, that apache was the parent process.

 

Oh well, whatever works.

 

CW

Link to comment
Share on other sites

But wouldn't truss (on Solaris) be a better fit?  From the man page, "truss - trace system calls and signals."  strace doesn't look like what you want there, as it only checks streams.

 

I messed up on the BSD equiv -- it's really ktrace and kdump.

 

Not sure I want to be a park ranger after what happened in northern WI befoer Thanksgiving (Hmong guy hunted down and shot 6-8 people because they told him to get out of thei tree stand...  Lovely).  The ranger caught him, but only because the guy ran out of bullets.  Lucky guy.

 

I love my job (sysadmin/architect - used to be an Oracle DBA as well, as well as an EMC/EVA storage architect/admin, but that's been scaled down to mainly Linux/Solaris/HPUX admin/architect/design).  I really want to start doing computer security, but the way things are going at my company, I'd need to go somewhere else as we don't focus on it very much yet :P

CW

160556[/snapback]

 

Nah, I like what I do, I just get fed up with all of the corporate red tape I need to wade through.

 

You're right, strace isn't what you want on solaris.. you want truss... strace is a streams trace utility on HPUX and Solaris. I can't count how many times I've typed 'strace -p XX' and had one of those OS' complain at me.

Link to comment
Share on other sites

what the hell is that top process and why has it been there so long?  How do I determine what it is and if it is bad - how do I kill it?

 

last pid: 55970;  load averages:  1.46,  1.44,  1.40  up 12+07:54:09  18:35:17

139 processes: 2 running, 137 sleeping

CPU states: 30.2% user,  0.0% nice, 69.8% system,  0.0% interrupt,  0.0% idle

Mem: 307M Active, 668M Inact, 264M Wired, 776K Cache, 199M Buf, 761M Free

Swap: 1020M Total, 23M Used, 996M Free, 2% Inuse

 

  PID USERNAME PRI NICE  SIZE    RES STATE    TIME  WCPU    CPU COMMAND

22744 www      61  0 58920K 12364K RUN    127:49 77.83% 77.83% httpd

25992 mysql      2  0  152M 86736K poll  154:25  7.42%  7.42% mysqld

22820 www        2  0 59076K 11648K accept  0:31  0.88%  0.88% httpd

22755 www        2  0 59192K 13120K accept  0:34  0.78%  0.78% httpd

22801 www        2  0 59064K 12516K accept  0:30  0.78%  0.78% httpd

22778 www        2  0 59068K 11528K accept  0:29  0.73%  0.73% httpd

22812 www        2  0 59136K 11592K accept  0:34  0.59%  0.59% httpd

22757 www        2  0 59116K 13176K accept  0:33  0.59%  0.59% httpd

22752 www        2  0 59096K 13276K accept  0:30  0.59%  0.59% httpd

22760 www        2  0 59104K 12568K accept  0:29  0.44%  0.44% httpd

22797 www        2  0 59072K 14372K accept  0:33  0.29%  0.29% httpd

22763 www        2  0 59072K 11808K accept  0:31  0.20%  0.20% httpd

160501[/snapback]

 

 

... ??? ... you computer guys are too much !!! ...

Link to comment
Share on other sites

×
×
  • Create New...