cpu ......100%......
hey ,
i noticed that some times my cpu usage is 100% , although i do not run any programs except maybe a mozilla browser and amarok mp3 player , the point is that it stuke like that all the time ... when i checked to know what proccess causes this i find that it's the X ... any body know what does this mean ?? and what is the reason of this ?? and how to solve this problem ... ! thank you all very much , muhammad-sameer , |
more detail ..
it's the x command it's user is root , it have an argument like this : -
/etc/X11/X -deferglyphs 16:0 -auth /var/run/xauth/A:0-5MZFyZ ... it take about 175 MB i have no idea what is this supposed to be ..?! m-s |
Did you verify that is the process taking up the CPU in top? X does run setuid root to talk directly to the video hardware, but it would usually be the X binary itself -- something running out of /var/run (not a normal place for binaries) looks somewhat suspicious. Have you looked at the file itself and run a rootkit scanner on your machine? What kind of specs does your system have?
|
hi ..
Quote:
Quote:
i use mandriva 2006 .. and i have IBM centrino 1.6 GHz ..! m-s |
I mean the actual executable that is taking up the CPU. When was the executable created? Was it something installed with your system? In general, executable programs don't get put into /var/run so something run there is a bit suspicious. Maybe Mandriva puts some component of the X server into there. It's hard to say what it is. It could be a sign that your system got broken into, but not necessarily -- you just have to investigate it. If possible, download chkrootkit and/or rkhunter to run on your system.
How much memory does your system have? Windowing systems like KDE require a lot of RAM. |
replay
Quote:
Quote:
m-s . |
Well, that ought to be enough memory.
Basically, rkhunter and chkrootkit look for signs that your system has been compromised by an attacker. They're not perfect, particularly if any attacker has replaced critical system binaries, but they can help. You sho In any case, I was re-reading your post and it's probably not a compromise (didn't quite read the full command line, sorry -- long day), but it never hurts to check if you notice strange behavior. It looksmore like a normal X windows process has gone awry. Have you tried simply killing the process in question? It might mess up your X windopws session, but it's worth a try. Have you changed your GUI configuration recently? If all else fails, try restarting the X server and see if the problem persists. |
replay
i'll try it later ...
Quote:
Quote:
i noticed that there have been threads with same subject ... but not realy helpful thanks alot , muhammad-sameer . |
Why is this X server listening on 6016 ?
What launched it ? (pstree) Have you more than one X server running ? |
...
Quote:
Quote:
m-s |
Try using ps to find the PID of the process, and then open up a terminal, become root, and issue the command "kill -9 <PID>" (no quotes). This basically nukes the process completely, and it's generally not a good idea since it doesn't give the process a chance to clean up after itself, but it's quite handy if you're desperate. Have you tried running a rootkit detector like I suggested?
Unfortunately, stuff like this can be hard to debug via a forum. Could you post the results of Code:
ls -l /etc/X11/X Code:
ps auxw |
Quote:
lrwxrwxrwx 1 root root 24 Nov 11 00:15 /etc/X11/X -> ../../usr/X11R6/bin/Xorg* about the other command it's not good idea to post the result because it's very long ... but i think this is relevant ... Quote:
Quote:
another thing about the argument file i mention above ( it's a photo ) sounds strang .. for me too ..! ( it's black ) Quote:
thanks for the help .. m-s |
No worries ... looks like the file in /etc/X11 is just a symbolic link to the main Xorg binary, so nuking that process will probably bring down your GUI. This pretty much also confirms that it's probably not a security issue, like I was originally thinking. I'm afraid I'm running aq bit low on ideas at this p[oint, but you might want to check your /var/log/Xorg.0.log file to see if X is reporting any hardware or software errors that might cause it to eat a lot of CPU. As I said, X does normally need a good amount of CPU power, but it should not be constantly using 100% of your processor.
Anyhow good luck with it all ... I'll post back if I get any more ideas. |
Quote:
This is unexpected, an X server is normally listening on TCP port 6000. Quote:
Quote:
Please use the pstree command to figure it out. |
Code:
─kdm─┬─X m-s |
All times are GMT -5. The time now is 10:52 AM. |