Re: What is using my CPU systemtime?

On 2006-01-21, Lin�nut <lin�nut@xxxxxxxx> wrote:
> After takin' a swig o' grog, Jan Wielemaker belched out this bit o' wisdom:
>
>> Tasks: 224 total, 1 running, 222 sleeping, 0 stopped, 1 zombie
>> Cpu(s): 6.8% us, 43.7% sy, 0.0% ni, 47.4% id, 2.0% wa, 0.2% hi, 0.0% si
>> Mem: 2074732k total, 1293468k used, 781264k free, 396160k buffers
>> Swap: 2097136k total, 390824k used, 1706312k free, 262388k cached
>>
>> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
>> 2036 jan 17 0 2100 1036 1764 R 0.7 0.0 0:00.22 top
>> 3893 nobody 16 0 1428 556 1264 S 0.3 0.0 7:48.98 portmap
>> 2049 root 15 0 0 0 0 S 0.3 0.0 0:19.66 pdflush
>> 1 root 16 0 596 80 452 S 0.0 0.0 0:04.35 init
>> 2 root RT 0 0 0 0 S 0.0 0.0 0:09.63 migration/0
>> 4 root RT 0 0 0 0 S 0.0 0.0 0:29.20 migration/1
>
> What the hell is "migration"?
>
> Obviously something wrong. Install and run chkrootkit.

migration is -as also hinted by the 0 memory usage-, a kernel task that is
part of SMP kernels. I have access to two other (completely independent)
SMP machines and they also have these tasks.

In addition, ntop doesn't show any unexpected network traffic, something
common if you've been hacked.

I'm mostly looking for a tool or way to analyse /proc that may tell me
what the hell is taking 100% of one of the CPUs. Appearently there is
exactly one process or kernel task that wants to spend full time on
system work. I can't find it by scanning /proc/<pid>/stat.

--- Jan
.

Relevant Pages