Hi, from time to time I have a process eating all my cpu-time which is called "exe". What is this? Thanks Karl -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On 30/08/09 14:02, Karl Sinn wrote:
Hi,
from time to time I have a process eating all my cpu-time which is called "exe". What is this?
most likley a rogue script, your server may be compromised. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Monday 31 August 2009 04:38:41 Cristian Rodríguez wrote:
On 30/08/09 14:02, Karl Sinn wrote:
Hi,
from time to time I have a process eating all my cpu-time which is called "exe". What is this?
most likley a rogue script, your server may be compromised.
Maybe not. There is a bug in nscd that causes it to restart itself with "exe" as a process name, if it is run in paranoia mode. It was reported to red hat at https://bugzilla.redhat.com/show_bug.cgi?id=490010 I can't find it in our bugzilla, but our code definitely has the same problem. To reproduce, enable paranoid mode in nscd, and set the restart interval to something low so you don't have to wait too long to see the problem. Then just wait for it to be restarted. Note that "ps" will still report the real process name, but top reports the false "exe" one (they read the name from different places in /proc) Perhaps that is hitting here. It wouldn't totally surprise me to see nscd spinning with 100% CPU. But comparing the ps output with the top output might show the truth. Anders -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Am Montag, 31. August 2009 05:54:25 schrieb Anders Johansson:
On Monday 31 August 2009 04:38:41 Cristian Rodríguez wrote:
On 30/08/09 14:02, Karl Sinn wrote:
Hi,
from time to time I have a process eating all my cpu-time which is called "exe". What is this?
most likley a rogue script, your server may be compromised.
Maybe not. There is a bug in nscd that causes it to restart itself with "exe" as a process name, if it is run in paranoia mode. It was reported to red hat at
https://bugzilla.redhat.com/show_bug.cgi?id=490010
I can't find it in our bugzilla, but our code definitely has the same problem. To reproduce, enable paranoid mode in nscd, and set the restart interval to something low so you don't have to wait too long to see the problem. Then just wait for it to be restarted.
Note that "ps" will still report the real process name, but top reports the false "exe" one (they read the name from different places in /proc)
Perhaps that is hitting here. It wouldn't totally surprise me to see nscd spinning with 100% CPU. But comparing the ps output with the top output might show the truth.
Do I understand that it's not a big problem, and I can just kill the process? Karl -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On 31/08/09 09:20, Karl Sinn wrote:
Do I understand that it's not a big problem, and I can just kill the process?
disable and stop the nscd service and see if it happends again, if it doesnt install package unscd and enable the service again. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
participants (3)
-
Anders Johansson
-
Cristian Rodríguez
-
Karl Sinn