Hi all,

I just get a new dedicated server running centos 5.2 with cpanel. There hardly anything going on the server right now but when i run top the load always at 0.40+, it the load always like that since i got the server. all my previous server never have such load when there nothing going, it either 0.01 - 0.05 at max.

Below is top output

top - 04:33:38 up 21 min, 1 user, load average: 0.39, 0.39, 0.27
Tasks: 152 total, 1 running, 151 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 8310948k total, 483064k used, 7827884k free, 22624k buffers
Swap: 4192956k total, 0k used, 4192956k free, 334120k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1 root 15 0 2064 644 556 S 0 0.0 0:01.90 init
2 root RT -5 0 0 0 S 0 0.0 0:00.00 migration/0
3 root 39 19 0 0 0 S 0 0.0 0:00.00 ksoftirqd/0
4 root RT -5 0 0 0 S 0 0.0 0:00.00 watchdog/0
5 root RT -5 0 0 0 S 0 0.0 0:00.00 migration/1
6 root 34 19 0 0 0 S 0 0.0 0:00.00 ksoftirqd/1
7 root RT -5 0 0 0 S 0 0.0 0:00.00 watchdog/1
8 root RT -5 0 0 0 S 0 0.0 0:00.00 migration/2
9 root 34 19 0 0 0 S 0 0.0 0:00.00 ksoftirqd/2
10 root RT -5 0 0 0 S 0 0.0 0:00.00 watchdog/2
11 root RT -5 0 0 0 S 0 0.0 0:00.00 migration/3
12 root 34 19 0 0 0 S 0 0.0 0:00.00 ksoftirqd/3
13 root RT -5 0 0 0 S 0 0.0 0:00.00 watchdog/3
14 root RT -5 0 0 0 S 0 0.0 0:00.00 migration/4
15 root 34 19 0 0 0 S 0 0.0 0:00.00 ksoftirqd/4
16 root RT -5 0 0 0 S 0 0.0 0:00.00 watchdog/4
17 root RT -5 0 0 0 S 0 0.0 0:00.00 migration/5

I did let top run for couple hour and watch the load, but it never get down. on average it at 0.40.

This is weird is something suspicious running in the background, what should i do to look for it and get the load down ?

Thank you

P.S. Top can actually do that load, as you where keep it alive. Also you have to know what applications are running on the server... if your using plesk or cpanel or whatever, even does can do the load. Check with "ps -ef" what u have on the system.

other server i had before also have cpanel running, but it never go that high.

here is the output of ps -ef

UID PID PPID C STIME TTY TIME CMD
root 1 0 0 04:12 ? 00:00:01 init [3]
root 2 1 0 04:12 ? 00:00:00 [migration/0]
root 3 1 0 04:12 ? 00:00:00 [ksoftirqd/0]
root 4 1 0 04:12 ? 00:00:00 [watchdog/0]
root 5 1 0 04:12 ? 00:00:00 [migration/1]
root 6 1 0 04:12 ? 00:00:00 [ksoftirqd/1]
root 7 1 0 04:12 ? 00:00:00 [watchdog/1]
root 8 1 0 04:12 ? 00:00:00 [migration/2]
root 9 1 0 04:12 ? 00:00:00 [ksoftirqd/2]
root 10 1 0 04:12 ? 00:00:00 [watchdog/2]
root 11 1 0 04:12 ? 00:00:00 [migration/3]
root 12 1 0 04:12 ? 00:00:00 [ksoftirqd/3]
root 13 1 0 04:12 ? 00:00:00 [watchdog/3]
root 14 1 0 04:12 ? 00:00:00 [migration/4]
root 15 1 0 04:12 ? 00:00:00 [ksoftirqd/4]
root 16 1 0 04:12 ? 00:00:00 [watchdog/4]
root 17 1 0 04:12 ? 00:00:00 [migration/5]
root 18 1 0 04:12 ? 00:00:00 [ksoftirqd/5]
root 19 1 0 04:12 ? 00:00:00 [watchdog/5]
root 20 1 0 04:12 ? 00:00:00 [migration/6]
root 21 1 0 04:12 ? 00:00:00 [ksoftirqd/6]
root 22 1 0 04:12 ? 00:00:00 [watchdog/6]
root 23 1 0 04:12 ? 00:00:00 [migration/7]
root 24 1 0 04:12 ? 00:00:00 [ksoftirqd/7]
root 25 1 0 04:12 ? 00:00:00 [watchdog/7]
root 26 1 0 04:12 ? 00:00:00 [events/0]
root 27 1 0 04:12 ? 00:00:00 [events/1]
root 28 1 0 04:12 ? 00:00:00 [events/2]
root 29 1 0 04:12 ? 00:00:00 [events/3]
root 30 1 0 04:12 ? 00:00:00 [events/4]
root 31 1 0 04:12 ? 00:00:00 [events/5]
root 32 1 0 04:12 ? 00:00:00 [events/6]
root 33 1 0 04:12 ? 00:00:00 [events/7]
root 34 1 0 04:12 ? 00:00:00 [khelper]
root 35 1 0 04:12 ? 00:00:00 [kthread]
root 45 35 0 04:12 ? 00:00:00 [kblockd/0]
root 46 35 0 04:12 ? 00:00:00 [kblockd/1]
root 47 35 0 04:12 ? 00:00:00 [kblockd/2]
root 48 35 0 04:12 ? 00:00:00 [kblockd/3]
root 49 35 0 04:12 ? 00:00:00 [kblockd/4]
root 50 35 0 04:12 ? 00:00:00 [kblockd/5]
root 51 35 0 04:12 ? 00:00:00 [kblockd/6]
root 52 35 0 04:12 ? 00:00:00 [kblockd/7]
root 53 35 0 04:12 ? 00:00:00 [kacpid]
root 148 35 0 04:12 ? 00:00:00 [cqueue/0]
root 149 35 0 04:12 ? 00:00:00 [cqueue/1]
root 150 35 0 04:12 ? 00:00:00 [cqueue/2]
root 151 35 0 04:12 ? 00:00:00 [cqueue/3]
root 152 35 0 04:12 ? 00:00:00 [cqueue/4]
root 153 35 0 04:12 ? 00:00:00 [cqueue/5]
root 154 35 0 04:12 ? 00:00:00 [cqueue/6]
root 155 35 0 04:12 ? 00:00:00 [cqueue/7]
root 158 35 0 04:12 ? 00:00:00 [khubd]
root 160 35 0 04:12 ? 00:00:00 [kseriod]
root 252 35 0 04:12 ? 00:00:00 [pdflush]
root 253 35 0 04:12 ? 00:00:00 [pdflush]
root 254 35 0 04:12 ? 00:00:00 [kswapd0]
root 255 35 0 04:12 ? 00:00:00 [aio/0]
root 256 35 0 04:12 ? 00:00:00 [aio/1]
root 257 35 0 04:12 ? 00:00:00 [aio/2]
root 258 35 0 04:12 ? 00:00:00 [aio/3]
root 259 35 0 04:12 ? 00:00:00 [aio/4]
root 260 35 0 04:12 ? 00:00:00 [aio/5]
root 261 35 0 04:12 ? 00:00:00 [aio/6]
root 262 35 0 04:12 ? 00:00:00 [aio/7]
root 422 35 0 04:12 ? 00:00:00 [kpsmoused]
root 499 35 0 04:12 ? 00:00:00 [ata/0]
root 500 35 0 04:12 ? 00:00:00 [ata/1]
root 501 35 0 04:12 ? 00:00:00 [ata/2]
root 502 35 0 04:12 ? 00:00:00 [ata/3]
root 503 35 0 04:12 ? 00:00:00 [ata/4]
root 504 35 0 04:12 ? 00:00:00 [ata/5]
root 505 35 0 04:12 ? 00:00:00 [ata/6]
root 506 35 0 04:12 ? 00:00:00 [ata/7]
root 507 35 0 04:12 ? 00:00:00 [ata_aux]
root 517 35 0 04:12 ? 00:00:00 [scsi_eh_0]
root 518 35 0 04:12 ? 00:00:00 [scsi_eh_1]
root 528 35 0 04:12 ? 00:00:00 [kjournald]
root 555 35 0 04:12 ? 00:00:00 [kauditd]
root 589 1 0 04:12 ? 00:00:00 /sbin/udevd -d
root 1572 35 0 04:12 ? 00:00:00 [kmpathd/0]
root 1573 35 0 04:12 ? 00:00:00 [kmpathd/1]
root 1574 35 0 04:12 ? 00:00:00 [kmpathd/2]
root 1575 35 0 04:12 ? 00:00:00 [kmpathd/3]
root 1576 35 0 04:12 ? 00:00:00 [kmpathd/4]
root 1577 35 0 04:12 ? 00:00:00 [kmpathd/5]
root 1578 35 0 04:12 ? 00:00:00 [kmpathd/6]
root 1579 35 0 04:12 ? 00:00:00 [kmpathd/7]
root 1615 35 0 04:12 ? 00:00:00 [kjournald]
root 1617 35 0 04:12 ? 00:00:00 [kjournald]
root 2183 1 0 04:12 ? 00:00:00 syslogd -m 0
root 2186 1 0 04:12 ? 00:00:00 klogd -x
root 2202 1 0 04:12 ? 00:00:00 irqbalance
rpc 2236 1 0 04:12 ? 00:00:00 portmap
root 2243 1 0 04:12 ? 00:00:00 /usr/sbin/courierlogger -pid=/var/spool/authdaemon/pid -facility=m
root 2244 2243 0 04:12 ? 00:00:00 /usr/libexec/courier-authlib/authdaemond
root 2256 2244 0 04:12 ? 00:00:00 /usr/libexec/courier-authlib/authdaemond
root 2257 2244 0 04:12 ? 00:00:00 /usr/libexec/courier-authlib/authdaemond
root 2258 2244 0 04:12 ? 00:00:00 /usr/libexec/courier-authlib/authdaemond
root 2259 2244 0 04:12 ? 00:00:00 /usr/libexec/courier-authlib/authdaemond
root 2261 2244 0 04:12 ? 00:00:00 /usr/libexec/courier-authlib/authdaemond
dbus 2275 1 0 04:12 ? 00:00:00 dbus-daemon --system
root 2327 1 0 04:12 ? 00:00:00 automount
named 2345 1 0 04:12 ? 00:00:00 /usr/sbin/named -u named
root 2410 1 0 04:12 ? 00:00:00 /usr/sbin/acpid
root 2445 1 0 04:12 ? 00:00:00 /usr/sbin/sshd
root 2460 1 0 04:12 ? 00:00:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --pid-file=/
mysql 2493 2460 0 04:12 ? 00:00:00 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql
root 2515 1 0 04:12 ? 00:00:00 /usr/sbin/courierlogger -pid=/var/run/imapd.pid -start -name=imapd
root 2516 2515 0 04:12 ? 00:00:00 /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50
root 2522 1 0 04:12 ? 00:00:00 /usr/sbin/courierlogger -pid=/var/run/imapd-ssl.pid -start -name=i
root 2523 2522 0 04:12 ? 00:00:00 /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50
root 2528 1 0 04:12 ? 00:00:00 /usr/sbin/courierlogger -pid=/var/run/pop3d.pid -start -name=pop3d
root 2529 2528 0 04:12 ? 00:00:00 /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50
root 2534 1 0 04:12 ? 00:00:00 /usr/sbin/courierlogger -pid=/var/run/pop3d-ssl.pid -start -name=p
root 2535 2534 0 04:12 ? 00:00:00 /usr/lib/courier-imap/libexec/couriertcpd -address=0 -maxprocs=50
mailnull 2964 1 0 04:12 ? 00:00:00 /usr/sbin/exim -bd -q1h
mailnull 2967 1 0 04:12 ? 00:00:00 /usr/sbin/exim -tls-on-connect -bd -oX 465
root 3059 1 0 04:12 ? 00:00:00 lfd - sleeping
root 3080 1 0 04:12 ? 00:00:00 gpm -m /dev/input/mice -t exps2
root 3109 1 0 04:12 ? 00:00:00 /usr/local/apache/bin/httpd -k start -DSSL
root 3125 1 0 04:12 ? 00:00:00 pure-ftpd (SERVER)
root 3129 1 0 04:12 ? 00:00:00 /usr/sbin/pure-authd -s /var/run/ftpd.sock -r /usr/sbin/pureauth
root 3144 1 0 04:12 ? 00:00:00 crond
root 3285 1 0 04:13 ? 00:00:00 cpdavd - accepting connections on 2077 and 2078
root 3291 1 0 04:13 ? 00:00:00 cpanellogd - sleeping for logs
root 3320 1 0 04:13 ? 00:00:00 tailwatchd
68 3349 1 0 04:13 ? 00:00:00 hald
root 3350 3349 0 04:13 ? 00:00:00 hald-runner
68 3359 3350 0 04:13 ? 00:00:00 hald-addon-acpi: listening on acpid socket /var/run/acpid.socket
root 3558 1 0 04:13 ? 00:00:00 /usr/sbin/smartd -q never
root 3561 1 0 04:13 tty1 00:00:00 /sbin/mingetty tty1
root 3562 1 0 04:13 tty2 00:00:00 /sbin/mingetty tty2
root 3563 1 0 04:13 tty3 00:00:00 /sbin/mingetty tty3
root 3564 1 0 04:13 tty4 00:00:00 /sbin/mingetty tty4
root 3565 1 0 04:13 tty5 00:00:00 /sbin/mingetty tty5
root 3567 1 0 04:13 tty6 00:00:00 /sbin/mingetty tty6
root 3627 1 0 04:13 ? 00:00:00 /usr/bin/python -tt /usr/sbin/yum-updatesd
root 3629 1 0 04:13 ? 00:00:00 /usr/libexec/gam_server
nobody 10349 3109 0 05:45 ? 00:00:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody 10350 3109 0 05:45 ? 00:00:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody 10351 3109 0 05:45 ? 00:00:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody 10352 3109 0 05:45 ? 00:00:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody 10353 3109 0 05:45 ? 00:00:00 /usr/local/apache/bin/httpd -k start -DSSL
root 10384 1 0 05:45 ? 00:00:00 /usr/bin/spamd -d --allowed-ips=127.0.0.1 --pidfile=/var/run/spamd
root 10416 10384 0 05:45 ? 00:00:00 spamd child
root 10417 10384 0 05:45 ? 00:00:00 spamd child
root 10798 1 0 05:45 ? 00:00:00 cpsrvd - waiting for connections
root 12715 9411 0 06:07 pts/0 00:00:00 su
root 12725 12715 0 06:08 pts/0 00:00:00 bash
nobody 13651 3109 0 06:15 ? 00:00:00 /usr/local/apache/bin/httpd -k start -DSSL
root 17431 10798 0 07:00 ? 00:00:00 whostmgrd - serving IP.Add.
root 17598 12725 0 07:01 pts/0 00:00:00 ps -ef

OK, try to run this small command:

while true; do ps -e -o user,pcpu,pid,cputime,args --no-heading|sort -k2 -n -r|head -9; sleep 5; clear; done

It will sort after the CPU usage. Maybe you will get a better info on it. Anyway you have quite some applications running, could be that one of them is working... a bit.

Check the system also with "vmstat" command, and iostat command.

i try your little command and here the output, there hardly any load

ing|sort -k2 -n -r |head -9; sleep 5; clear; done
rpc 0.0 2236 00:00:00 portmap
root 0.0 9 00:00:00 [ksoftirqd/2]
root 0.0 8 00:00:00 [migration/2]
root 0.0 7 00:00:00 [watchdog/1]
root 0.0 6 00:00:00 [ksoftirqd/1]
root 0.0 589 00:00:00 /sbin/udevd -d
root 0.0 555 00:00:00 [kauditd]
root 0.0 53 00:00:00 [kacpid]
root 0.0 528 00:00:04 [kjournald]
rpc 0.0 2236 00:00:00 portmap
root 0.0 9 00:00:00 [ksoftirqd/2]
root 0.0 8 00:00:00 [migration/2]
root 0.0 7 00:00:00 [watchdog/1]
root 0.0 6 00:00:00 [ksoftirqd/1]
root 0.0 589 00:00:00 /sbin/udevd -d
root 0.0 555 00:00:00 [kauditd]
root 0.0 53 00:00:00 [kacpid]
root 0.0 528 00:00:04 [kjournald]
rpc 0.0 2236 00:00:00 portmap
root 0.0 9 00:00:00 [ksoftirqd/2]
root 0.0 8 00:00:00 [migration/2]
root 0.0 7 00:00:00 [watchdog/1]
root 0.0 6 00:00:00 [ksoftirqd/1]
root 0.0 589 00:00:00 /sbin/udevd -d
root 0.0 555 00:00:00 [kauditd]
root 0.0 53 00:00:00 [kacpid]
root 0.0 528 00:00:04 [kjournald]

this weird, i tried ps -ef on my old server and the list was much more compare to my new, but the averge load is .12 .09 .01 with traffic, while the new server has no traffic

I didnt get you

Sorry, I forgot to tell you, stop rpc and portmap, you dont need them.

/etc/init.d/nfslock stop
/etc/init.d/portmap stop
/etc/init.d/rpc... stop

chkconfig nfslock off
chkconfig portmap off
chkconfig rpc... off

rpc... is rpc and something, they are 3 services, and it think 2 of them run by default, just dont remember which.

i kill those off but it doesn't help much on the load.

what should the average load for a server that doesn't have have any traffic. 0.4 on the load with no traffic have me worry something not good running in the background.

hmm,

something is running in the background after 5 mins from boot up. Because after I reboot and ran top and look at it for a while the server settle down to 0.01 after boot up then right at 5 mins uptime it graduallty go to up .5.

There must be something in cron that schedule it to run ? I check /etc/crontab but haven't found it yet, where else can i look, which command should i use ?

thank you

There are a lot of stuff ran by cron and you can find them in:

/etc/cron.hourly/
/etc/cron.daily/
/etc/cron.weekly/
/etc/cron.monthly/
/etc/cron.d/
/etc/crontab

Check them, you should have some scripts which are started by cron. Could be something there.

Also check /var/spool/cron/, could be added some stuff from users or root itself.