Hai all,,


command bash consumes 100% of CPU....

is this normal ? ..

**********************************************************************
[oraprod@alioracle bdump]$ top
top - 10:16:57 up 7 days, 1:29, 4 users, load average: 1.01, 1.10, 1.09
Tasks: 453 total, 2 running, 451 sleeping, 0 stopped, 0 zombie
Cpu(s): 13.1% us, 0.4% sy, 0.0% ni, 85.5% id, 0.9% wa, 0.0% hi, 0.0% si
Mem: 4148304k total, 4127872k used, 20432k free, 12788k buffers
Swap: 8217236k total, 161224k used, 8056012k free, 2832452k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
24420 root 25 0 13732 9568 1212 R 100 0.2 3995:21 bash
1383 oraprod 16 0 2260 1184 756 R 1 0.0 0:00.34 top
18284 applprod 16 0 11428 8128 2644 S 1 0.2 1:33.43 FNDLIBR
16801 applprod 16 0 779m 205m 13m S 0 5.1 6:23.68 java
16803 applprod 16 0 749m 57m 8448 S 0 1.4 1:43.99 java
18331 oraprod 16 0 614m 275m 274m S 0 6.8 15:47.31 oracle
18587 oraprod 16 0 614m 182m 179m S 0 4.5 0:14.18 oracle
1 root 16 0 1876 592 504 S 0 0.0 0:06.31 init
2 root RT 0 0 0 0 S 0 0.0 0:00.48 migration/0
3 root 34 19 0 0 0 S 0 0.0 0:00.00 ksoftirqd/0
4 root RT 0 0 0 0 S 0 0.0 0:00.19 migration/1
*********************************************************************
output of sar :



Linux 2.6.9-42.ELsmp (alioracle.ali.com.kw) 11/11/2007

10:16:07 AM CPU %user %nice %system %iowait %idle
10:16:08 AM all 12.59 0.00 0.12 0.00 87.28
10:16:09 AM all 12.62 0.00 0.00 0.00 87.38
10:16:10 AM all 13.09 0.00 0.25 0.50 86.16
10:16:11 AM all 12.75 0.00 0.12 0.00 87.12
10:16:12 AM all 12.62 0.00 0.00 0.00 87.38
Average: all 12.74 0.00 0.10 0.10 87.06
***************************************************************



Is this normal ?


Thanks
Yusuf







*********************************************************************

I wouldnt say its normal.

Can anyone how to debug and solve the above issue ?


Thanks
Yusuf

Start stopping some services. Use a LIVE Linux distribution like Knoppix and do a rootkit scan. If bash has been compromise, revert to an old full backup. Before putting the system on the network, run a file monitor, so you know what is happening to your files.

Difficult to say without having access to the machine.

Electro's proposals are good to being with, and in combination you should consider scanning IP traffic that might be emitted via bash, and maybe run a virus/malware scanner. There are hardly any successful viruses out there for linux, but its not completely "safe".

As I said, difficult to say without being there to visualise what is happening.

Thanks Kerato and Electro.. all the ideas that you've given will be very simple to you.. as am a newbie, I have to learn all this.
Anyway, thanks... let me try my best in this issue.

Yusuf