SDS Posted December 14, 2004 Share Posted December 14, 2004 what the hell is that top process and why has it been there so long? How do I determine what it is and if it is bad - how do I kill it? last pid: 55970; load averages: 1.46, 1.44, 1.40 up 12+07:54:09 18:35:17 139 processes: 2 running, 137 sleeping CPU states: 30.2% user, 0.0% nice, 69.8% system, 0.0% interrupt, 0.0% idle Mem: 307M Active, 668M Inact, 264M Wired, 776K Cache, 199M Buf, 761M Free Swap: 1020M Total, 23M Used, 996M Free, 2% Inuse PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND 22744 www 61 0 58920K 12364K RUN 127:49 77.83% 77.83% httpd 25992 mysql 2 0 152M 86736K poll 154:25 7.42% 7.42% mysqld 22820 www 2 0 59076K 11648K accept 0:31 0.88% 0.88% httpd 22755 www 2 0 59192K 13120K accept 0:34 0.78% 0.78% httpd 22801 www 2 0 59064K 12516K accept 0:30 0.78% 0.78% httpd 22778 www 2 0 59068K 11528K accept 0:29 0.73% 0.73% httpd 22812 www 2 0 59136K 11592K accept 0:34 0.59% 0.59% httpd 22757 www 2 0 59116K 13176K accept 0:33 0.59% 0.59% httpd 22752 www 2 0 59096K 13276K accept 0:30 0.59% 0.59% httpd 22760 www 2 0 59104K 12568K accept 0:29 0.44% 0.44% httpd 22797 www 2 0 59072K 14372K accept 0:33 0.29% 0.29% httpd 22763 www 2 0 59072K 11808K accept 0:31 0.20% 0.20% httpd Link to comment Share on other sites More sharing options...
Fezmid Posted December 14, 2004 Share Posted December 14, 2004 It's probably just an apache process. Could be a runaway, you could try bouncing apache (apachectl restart). Alternatively, make sure that it really is just that: $ ps -axj | grep http (returns output similar to:) root 11047 1 11047 e7b37090 0 Is ?? 0:02.51 httpd: parent (httpd) www 3955 11047 11047 e7b37090 0 I ?? 0:01.21 httpd: child (httpd) www 12299 11047 11047 e7b37090 0 I ?? 0:01.39 httpd: child (httpd) www 13025 11047 11047 e7b37090 0 I ?? 0:00.61 httpd: child (httpd) www 19646 11047 11047 e7b37090 0 I ?? 0:02.12 httpd: child (httpd) www 1752 11047 11047 e7b37090 0 I ?? 0:01.57 httpd: child (httpd) www 24425 11047 11047 e7b37090 0 I ?? 0:01.06 httpd: child (httpd) www 4362 11047 11047 e7b37090 0 I ?? 0:01.14 httpd: child (httpd) www 3451 11047 11047 e7b37090 0 I ?? 0:01.61 httpd: child (httpd) www 18769 11047 11047 e7b37090 0 I ?? 0:00.88 httpd: child (httpd) www 15917 11047 11047 e7b37090 0 I ?? 0:02.62 httpd: child (httpd) or: $ ps -axj | grep 22744 If the parent process is the same as the root owned process (11047 in my case), then it's just a thread. CW Link to comment Share on other sites More sharing options...
Tux of Borg Posted December 15, 2004 Share Posted December 15, 2004 Depending on how you have the server set up. You can sometimes do an strace and cat out the results to a file. If a process is getting hung up somewhere, that will tell you where. Link to comment Share on other sites More sharing options...
Fezmid Posted December 15, 2004 Share Posted December 15, 2004 Depending on how you have the server set up. You can sometimes do an strace and cat out the results to a file. If a process is getting hung up somewhere, that will tell you where. 160511[/snapback] As clarification, it's systrace in BSD, truss on Solaris, and I can't remember what it is on Linux or HPUX because my brain's mush from a RAID problem I fought with the past 2 days. (interesting aside [probably to nobody but myself]; had a RAID-5 setup with 6 disks in the array. "Lost" two of them when someone unplugged them and plugged them back in, and was able to restore the array AND the filesystem with no data loss. Thank god, because the site hadn't bothered to actually take backups of roughly 250G of the 550G of data. Idiots...) CW Link to comment Share on other sites More sharing options...
Nervous Guy Posted December 15, 2004 Share Posted December 15, 2004 Link to comment Share on other sites More sharing options...
crackur Posted December 15, 2004 Share Posted December 15, 2004 this is the most uninteresting stuff I have ever seen Link to comment Share on other sites More sharing options...
Fezmid Posted December 15, 2004 Share Posted December 15, 2004 this is the most uninteresting stuff I have ever seen 160546[/snapback] Without it, there'd be no web, no online shopping, no message boards, no online banking, no TVs (yes, most TVs nowadays actually run embedded Linux), etc. CW Link to comment Share on other sites More sharing options...
mcjeff215 Posted December 15, 2004 Share Posted December 15, 2004 As clarification, it's systrace in BSD, truss on Solaris, and I can't remember what it is on Linux or HPUX because my brain's mush from a RAID problem I fought with the past 2 days. (interesting aside [probably to nobody but myself]; had a RAID-5 setup with 6 disks in the array. "Lost" two of them when someone unplugged them and plugged them back in, and was able to restore the array AND the filesystem with no data loss. Thank god, because the site hadn't bothered to actually take backups of roughly 250G of the 550G of data. Idiots...) CW 160522[/snapback] strace on linux, but the command of the same name on Solaris and HPUX is "streams" trace, which are a sysVism.. not to be confused with file io streams, which are actually implemented as streams... It's truss on HPUX, too. I hate computers. I think I'll go back to school and be a park ranger. Link to comment Share on other sites More sharing options...
mead107 Posted December 15, 2004 Share Posted December 15, 2004 the brains have to figure this out . i just a moron Link to comment Share on other sites More sharing options...
mcjeff215 Posted December 15, 2004 Share Posted December 15, 2004 this is the most uninteresting stuff I have ever seen 160546[/snapback] Yeah, same here and I do it for a living. Actually, I don't do this exactly per se, I do architecture design. I need to stop being so cynical. It actually is quite interesting if you're in a good company. -Jeff Link to comment Share on other sites More sharing options...
crackur Posted December 15, 2004 Share Posted December 15, 2004 Without it, there'd be no web, no online shopping, no message boards, no online banking, no TVs (yes, most TVs nowadays actually run embedded Linux), etc. CW 160547[/snapback] lol I know just like classes at college.......u have to havem .....but it still is uninteresting Link to comment Share on other sites More sharing options...
Fezmid Posted December 15, 2004 Share Posted December 15, 2004 strace on linux, but the command of the same name on Solaris and HPUX is "streams" trace, which are a sysVism.. not to be confused with file io streams, which are actually implemented as streams... It's truss on HPUX, too. I hate computers. I think I'll go back to school and be a park ranger. 160548[/snapback] But wouldn't truss (on Solaris) be a better fit? From the man page, "truss - trace system calls and signals." strace doesn't look like what you want there, as it only checks streams. I messed up on the BSD equiv -- it's really ktrace and kdump. Not sure I want to be a park ranger after what happened in northern WI befoer Thanksgiving (Hmong guy hunted down and shot 6-8 people because they told him to get out of thei tree stand... Lovely). The ranger caught him, but only because the guy ran out of bullets. Lucky guy. I love my job (sysadmin/architect - used to be an Oracle DBA as well, as well as an EMC/EVA storage architect/admin, but that's been scaled down to mainly Linux/Solaris/HPUX admin/architect/design). I really want to start doing computer security, but the way things are going at my company, I'd need to go somewhere else as we don't focus on it very much yet CW Link to comment Share on other sites More sharing options...
SDS Posted December 15, 2004 Author Share Posted December 15, 2004 I killed it. It was taking up to 90% of the cpu. this is bad if apache doesn't kill it off. something must be wrong.... Link to comment Share on other sites More sharing options...
mcjeff215 Posted December 15, 2004 Share Posted December 15, 2004 what the hell is that top process and why has it been there so long? How do I determine what it is and if it is bad - how do I kill it? last pid: 55970; load averages: 1.46, 1.44, 1.40 up 12+07:54:09 18:35:17 139 processes: 2 running, 137 sleeping CPU states: 30.2% user, 0.0% nice, 69.8% system, 0.0% interrupt, 0.0% idle Mem: 307M Active, 668M Inact, 264M Wired, 776K Cache, 199M Buf, 761M Free Swap: 1020M Total, 23M Used, 996M Free, 2% Inuse PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND 22744 www 61 0 58920K 12364K RUN 127:49 77.83% 77.83% httpd 25992 mysql 2 0 152M 86736K poll 154:25 7.42% 7.42% mysqld 22820 www 2 0 59076K 11648K accept 0:31 0.88% 0.88% httpd 22755 www 2 0 59192K 13120K accept 0:34 0.78% 0.78% httpd 22801 www 2 0 59064K 12516K accept 0:30 0.78% 0.78% httpd 22778 www 2 0 59068K 11528K accept 0:29 0.73% 0.73% httpd 22812 www 2 0 59136K 11592K accept 0:34 0.59% 0.59% httpd 22757 www 2 0 59116K 13176K accept 0:33 0.59% 0.59% httpd 22752 www 2 0 59096K 13276K accept 0:30 0.59% 0.59% httpd 22760 www 2 0 59104K 12568K accept 0:29 0.44% 0.44% httpd 22797 www 2 0 59072K 14372K accept 0:33 0.29% 0.29% httpd 22763 www 2 0 59072K 11808K accept 0:31 0.20% 0.20% httpd 160501[/snapback] If I had to guess (and I will), it's a PHP script. You're running mod_php, so PHP scripts are processed "in process" by the web server. You probably happened to run top while PHP was crunching something. Edit... I didn't notice the CPU time... I stand by the above statement, but perhaps the PHP code got stuck in a loop. -Jeff Link to comment Share on other sites More sharing options...
Fezmid Posted December 15, 2004 Share Posted December 15, 2004 I killed it. It was taking up to 90% of the cpu. this is bad if apache doesn't kill it off. something must be wrong.... 160557[/snapback] I hope you didn't just kill it; restarting apache would've been the more graceful way to go. Not sure if Apache will be happy if one of its threads just up and died... Assuming, of course, that apache was the parent process. Oh well, whatever works. CW Link to comment Share on other sites More sharing options...
mcjeff215 Posted December 15, 2004 Share Posted December 15, 2004 But wouldn't truss (on Solaris) be a better fit? From the man page, "truss - trace system calls and signals." strace doesn't look like what you want there, as it only checks streams. I messed up on the BSD equiv -- it's really ktrace and kdump. Not sure I want to be a park ranger after what happened in northern WI befoer Thanksgiving (Hmong guy hunted down and shot 6-8 people because they told him to get out of thei tree stand... Lovely). The ranger caught him, but only because the guy ran out of bullets. Lucky guy. I love my job (sysadmin/architect - used to be an Oracle DBA as well, as well as an EMC/EVA storage architect/admin, but that's been scaled down to mainly Linux/Solaris/HPUX admin/architect/design). I really want to start doing computer security, but the way things are going at my company, I'd need to go somewhere else as we don't focus on it very much yet CW 160556[/snapback] Nah, I like what I do, I just get fed up with all of the corporate red tape I need to wade through. You're right, strace isn't what you want on solaris.. you want truss... strace is a streams trace utility on HPUX and Solaris. I can't count how many times I've typed 'strace -p XX' and had one of those OS' complain at me. Link to comment Share on other sites More sharing options...
cåblelady Posted December 15, 2004 Share Posted December 15, 2004 Oh well, whatever works. 160562[/snapback] Can I be a smart*ss now ? Link to comment Share on other sites More sharing options...
mcjeff215 Posted December 15, 2004 Share Posted December 15, 2004 Can I be a smart*ss now ? 160566[/snapback] No not yet... hoooold.. iiittt.... not yet... hoooollldddd it... hoooolllddd it... ok, go 'head. Link to comment Share on other sites More sharing options...
cåblelady Posted December 15, 2004 Share Posted December 15, 2004 No not yet... hoooold.. iiittt.... not yet... hoooollldddd it... hoooolllddd it... ok, go 'head. 160570[/snapback] Well......it's......the.......bunnies.......I tell ya. Link to comment Share on other sites More sharing options...
TSNBDSC Posted December 15, 2004 Share Posted December 15, 2004 what the hell is that top process and why has it been there so long? How do I determine what it is and if it is bad - how do I kill it? last pid: 55970; load averages: 1.46, 1.44, 1.40 up 12+07:54:09 18:35:17 139 processes: 2 running, 137 sleeping CPU states: 30.2% user, 0.0% nice, 69.8% system, 0.0% interrupt, 0.0% idle Mem: 307M Active, 668M Inact, 264M Wired, 776K Cache, 199M Buf, 761M Free Swap: 1020M Total, 23M Used, 996M Free, 2% Inuse PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND 22744 www 61 0 58920K 12364K RUN 127:49 77.83% 77.83% httpd 25992 mysql 2 0 152M 86736K poll 154:25 7.42% 7.42% mysqld 22820 www 2 0 59076K 11648K accept 0:31 0.88% 0.88% httpd 22755 www 2 0 59192K 13120K accept 0:34 0.78% 0.78% httpd 22801 www 2 0 59064K 12516K accept 0:30 0.78% 0.78% httpd 22778 www 2 0 59068K 11528K accept 0:29 0.73% 0.73% httpd 22812 www 2 0 59136K 11592K accept 0:34 0.59% 0.59% httpd 22757 www 2 0 59116K 13176K accept 0:33 0.59% 0.59% httpd 22752 www 2 0 59096K 13276K accept 0:30 0.59% 0.59% httpd 22760 www 2 0 59104K 12568K accept 0:29 0.44% 0.44% httpd 22797 www 2 0 59072K 14372K accept 0:33 0.29% 0.29% httpd 22763 www 2 0 59072K 11808K accept 0:31 0.20% 0.20% httpd 160501[/snapback] ... ??? ... you computer guys are too much !!! ... Link to comment Share on other sites More sharing options...
TSNBDSC Posted December 15, 2004 Share Posted December 15, 2004 this is the most uninteresting stuff I have ever seen 160546[/snapback] ... LMAO ... good one ! ... god bless these guys though for keeping everything up and running ! ... Link to comment Share on other sites More sharing options...
Alaska Darin Posted December 15, 2004 Share Posted December 15, 2004 the brains have to figure this out . i just a moron 160550[/snapback] There's news. Link to comment Share on other sites More sharing options...
SDS Posted December 15, 2004 Author Share Posted December 15, 2004 If I had to guess (and I will), it's a PHP script. You're running mod_php, so PHP scripts are processed "in process" by the web server. You probably happened to run top while PHP was crunching something. Edit... I didn't notice the CPU time... I stand by the above statement, but perhaps the PHP code got stuck in a loop. -Jeff 160558[/snapback] not anymore.... those puppies are cached. and as long as this was some freak thing that rarely happens - it is good news cause it probably explains the load jump at 3:00pm and after. after I killed it - the load went to nothing and the execution time plummeted. My hopes are once again on the rise. Link to comment Share on other sites More sharing options...
cåblelady Posted December 15, 2004 Share Posted December 15, 2004 not anymore.... those puppies are cached. 160596[/snapback] bunnies, Scott.......bunnies. P.S. I love you. Link to comment Share on other sites More sharing options...
IDBillzFan Posted December 15, 2004 Share Posted December 15, 2004 It's probably just an apache process. Could be a runaway, you could try bouncing apache (apachectl restart). Alternatively, make sure that it really is just that: $ ps -axj | grep http (returns output similar to:) root 11047 1 11047 e7b37090 0 Is ?? 0:02.51 httpd: parent (httpd) www 3955 11047 11047 e7b37090 0 I ?? 0:01.21 httpd: child (httpd) www 12299 11047 11047 e7b37090 0 I ?? 0:01.39 httpd: child (httpd) www 13025 11047 11047 e7b37090 0 I ?? 0:00.61 httpd: child (httpd) www 19646 11047 11047 e7b37090 0 I ?? 0:02.12 httpd: child (httpd) www 1752 11047 11047 e7b37090 0 I ?? 0:01.57 httpd: child (httpd) www 24425 11047 11047 e7b37090 0 I ?? 0:01.06 httpd: child (httpd) www 4362 11047 11047 e7b37090 0 I ?? 0:01.14 httpd: child (httpd) www 3451 11047 11047 e7b37090 0 I ?? 0:01.61 httpd: child (httpd) www 18769 11047 11047 e7b37090 0 I ?? 0:00.88 httpd: child (httpd) www 15917 11047 11047 e7b37090 0 I ?? 0:02.62 httpd: child (httpd) or: $ ps -axj | grep 22744 If the parent process is the same as the root owned process (11047 in my case), then it's just a thread. CW 160506[/snapback] Whenever I see posts like this, I'm reminded of an old Steve Martin joke off his "Let's Get Small" album from 1978 or 1979. I actually had to register at a Steve Martin fan site, post a thread asking for the joke, and wait about three weeks for someone to see the thread and respond. But it was worth it, because I think of this joke everytime I see programmers talk online. Ok, I don't like to gear my material to the audience but I'd like to make an exception because I was told that there is a convention of plumbers in San Francisco this week - I understand about 30 of them came down to the show tonight - so before I came out I worked-up a joke especially for the plumbers. Those of you who aren't plumbers probably won't get this and won't think it's funny, but I think those of you who are plumbers will really enjoy this... This lawn supervisor was out on a sprinkler maintenance job and he started working on a Findlay sprinkler head with a Langstrom 7" gangly wrench. Just then, this little apprentice leaned over and said, "You can't work on a Findlay sprinkler head with a Langstrom 7" wrench." Well this infuriated the supervisor, so he went and got Volume 14 of the Kinsley manual, and he reads to him and says, "The Langstrom 7" wrench can be used with the Findlay sprocket." Just then, the little apprentice leaned over and said, "It says sprocket not socket!" Link to comment Share on other sites More sharing options...
Fezmid Posted December 15, 2004 Share Posted December 15, 2004 Whenever I see posts like this, I'm reminded of an old Steve Martin joke off his "Let's Get Small" album from 1978 or 1979. I actually had to register at a Steve Martin fan site, post a thread asking for the joke, and wait about three weeks for someone to see the thread and respond. But it was worth it, because I think of this joke everytime I see programmers talk online.Ok, I don't like to gear my material to the audience but I'd like to make an exception because I was told that there is a convention of plumbers in San Francisco this week - I understand about 30 of them came down to the show tonight - so before I came out I worked-up a joke especially for the plumbers. Those of you who aren't plumbers probably won't get this and won't think it's funny, but I think those of you who are plumbers will really enjoy this... This lawn supervisor was out on a sprinkler maintenance job and he started working on a Findlay sprinkler head with a Langstrom 7" gangly wrench. Just then, this little apprentice leaned over and said, "You can't work on a Findlay sprinkler head with a Langstrom 7" wrench." Well this infuriated the supervisor, so he went and got Volume 14 of the Kinsley manual, and he reads to him and says, "The Langstrom 7" wrench can be used with the Findlay sprocket." Just then, the little apprentice leaned over and said, "It says sprocket not socket!" 160609[/snapback] Are you making fun of me (us)? CW Link to comment Share on other sites More sharing options...
Fezmid Posted December 15, 2004 Share Posted December 15, 2004 P.S. I love you. 160601[/snapback] Hey, share the wealth! CW Link to comment Share on other sites More sharing options...
Tux of Borg Posted December 15, 2004 Share Posted December 15, 2004 I hope you didn't just kill it; restarting apache would've been the more graceful way to go. Not sure if Apache will be happy if one of its threads just up and died... Assuming, of course, that apache was the parent process. Oh well, whatever works. CW 160562[/snapback] kill -9 is the only way to go. Link to comment Share on other sites More sharing options...
cåblelady Posted December 15, 2004 Share Posted December 15, 2004 Hey, share the wealth! CW 160626[/snapback] I love you, too......but, don't tell Jen. Link to comment Share on other sites More sharing options...
Fezmid Posted December 15, 2004 Share Posted December 15, 2004 I love you, too......but, don't tell Jen. 160646[/snapback] Our little secret. CW Link to comment Share on other sites More sharing options...
theesir Posted December 15, 2004 Share Posted December 15, 2004 I can't believe that my wife and kid are in bed and I'm on the internet reading every post in THIS thread. Link to comment Share on other sites More sharing options...
cåblelady Posted December 15, 2004 Share Posted December 15, 2004 I can't believe that my wife and kid are in bed and I'm on the internet reading every post in THIS thread. 160679[/snapback] Go to bed. Link to comment Share on other sites More sharing options...
BILLS4LIFE Posted December 15, 2004 Share Posted December 15, 2004 I can't believe that my wife and kid are in bed and I'm on the internet reading every post in THIS thread. 160679[/snapback] You need your sleep. Link to comment Share on other sites More sharing options...
Recommended Posts