D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] Unusual activiy...

 

On Sat, 18 Jun 2005 23:12:17 +0100
Neil Williams wrote:

> On Saturday 18 June 2005 10:58 pm, Grant Sewell wrote:
> > Just recently my main computer (Debian Sid) has been acting a little bit
> > strangely.  About every 3rd day or so, at about 10:30pmish the harddrive
> > thrashes like you wouldn't believe
> 
> Sounds like logrotate or another maintenance task. Inspect the crontab of the 
> root user.
> # crontab -l

Yeah, I thought about that too.  I have no root-user-crontab, only a system crontab, 
and there don't appear to be any entries that run at 10:30pm:

/etc/cronttab:
17 *    * * *   root    run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || run-parts --report 
/etc/cron.daily
47 6    * * 7   root    test -x /usr/sbin/anacron || run-parts --report 
/etc/cron.weekly
52 6    1 * *   root    test -x /usr/sbin/anacron || run-parts --report 
/etc/cron.monthly

contents of /etc/cron.daily, cron.weekly, and cron.monthly (cron.hourly is an empty 
directory):
# ls /etc/cron.daily/
5snort        cfengine    find       man-db    netkit-inetd  samba  standard  
tetex-bin  webmin-ldap-user-simple
bsdmainutils  exim4-base  logrotate  modutils  quota         slapd  sysklogd  
webalizer
# ls /etc/cron.weekly/
cfengine  cvs  kdevelop3  lpr  man2html  man-db  smsclient  sysklogd
# ls /etc/cron.monthly/
proftpd  scrollkeeper  standard

I was thinking that it might be snort, but (if I'm reading the cronttab correctly) 
it should be run daily at 06:25am?

> > and bring the machine to an unusably 
> > slow state for about 10-15 minutes, and then resumes business as normal,
> 
> A second box would be the most useful thing. SSH into the main computer from 
> the second box prior to the activation, then watch a 'top' report.

Done that.  When I try to ssh in it just sits there and waits for the 10-15 minutes 
until the system has calmed down again.  Also tried switching to another virtual 
terminal, that works but is unbearably slow.  Running top doesn't seem to show 
anything untoward, certainly there doesn't seem to be anything that's using lots of 
CPU time, although kswapd does seem to be higher up the list than normal.

 
> > but for some reason KDE has lost it's ability to actually manage Windows or
> > virtual desktops, so I cannot actually do anything besides reset the X
> > session, which is not ideal.
> 
> Probably not to be recommended, either. What you need is for this to happen at 
> another time, rather than be interrupted.

That's what I'm getting at.  Although I don't know what is causing this, I would be 
very surprised if it wasn't *something* to do with normal activity.  However, since 
I don't know what's causing it, I cannot interrupt it.  What I was saying is that 
once the system has calmed down again, KDE seems to have forgotten it's job.  
Windows no longer have borders or title bars; the kicker is present but does 
nothing; right-clicking on the desktop does produce a context menu, but clicking on 
"run command" does nothing at all.  Since the kicker seems to be non-functioning, I 
can't even logout of KDE properly, so a <CTRL><ALT><BackSpace> is needed.  I'll note 
again, I am not interrupting the process that causes the machine to go nuts - I 
cannot since I don't know what it is.

> > Incidentally, and I have no idea whether this is related or not but... I
> > have noticed that I also seem to have an unusual process running:
> > /USR/SBIN/CRON.  Now, I know cron is not unusual, but should it be in upper
> > case when shown with "ps auxwww"?
> 
> Makes no odds. It's the task cron is running that matters.

Yes, I know that cron itself doesn't really make a difference.  What I was asking 
here is should it be in upper case?  There are 0 other processes, even those with a 
full path in their description, that are in upper case.  Is it normal for cron to be 
in uppercase, or *anything* else for that matter to ever be in upper case like this?

Grant.
-- 
Artificial intelligence is no match for nuratal stidutipy.

--
The Mailing List for the Devon & Cornwall LUG
Mail majordomo@xxxxxxxxxxxxx with "unsubscribe list" in the
message body to unsubscribe. FAQ: www.dcglug.org.uk/linux_adm/list-faq.html