Server almost locked!
 

Hi!

Yesterday I was working on one of my servers (in a webfarm so, just ssh access). After a while it 's gome crazy: it become extremely slow: it took a couple of hours and dozen of tries to get an ssh access and reboot the server. After that it worked fine but I'm trying to understand why this happened:
just before the reboot I've done a "ps aux" and this is the result:

I cut some entries because the post was too big.
Can anybody tell me why some processes has so much multiplied?
I was'nt doing stranged things, except this command:
find / -type f -print0 | xargs -0 grep "obscureCreditCard"

Help please!

Alex

Also The find operations would put a pretty big I/O burden on the machine, and if there are frequent cron jobs running that cause a lot of disk access too, it's likely they would start piling up, i.e. the next cron job would start before the previous one was finished, thus making all processes slower, then causing those jobs to not finish before the next one starts, etc...

It's difficult to say what's going on, especially since you left out some of the potentially important processes. The find that you listed looks very much like someone has broken into your machine and is looking for credit card data to steal.

The find has been fired by me, as I was looking for a function inside a php library. I didn't guessed that it could lock the server in that way! While some process about webmin scripts could have been been opened by my desperate requests to get in and reboot the so many "cron" have really no explanation.
Maybe the "find", from the root path and launched as root has touched something, who knows, in /dev or /procs?

The cron jobs most likely rotate logs, or try to restart dead services, or any other number of typical system clean-up tasks. You can see what they do with crontab -l as the appropriate user. If they're being run as root, you would have to do sudo crontab -l.