LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Linux Mint
User Name
Password
Linux Mint This forum is for the discussion of Linux Mint.

Notices


Reply
  Search this Thread
Old 08-11-2018, 10:18 AM   #1
Fred Caro
Senior Member
 
Registered: May 2007
Posts: 1,006

Rep: Reputation: 166Reputation: 166
Recent update causes high cpu usage


I am currently running Mint 18.3 initially installed with KDE, now usually run Xfce and have done so for a while without problems until a recent update. Now the cpu is racing away at an average of about 25%, this is shared over 6 processors. It has nothing running apart from the Xfce gui. Usually this would only average about 0.1 to 2% but it runs at 25% unless I run top which (without me doing anything else) seems to quell the enthusiasm of the offending processes and usage returns to normal, providing I don't shutdown top.

The offending processes have been:
systemd
gvfsd
systemctl

but not all at once, i, e, only one at once. (as reported by top)

Also it will behave itself if I don't login from the splash page but give Ctrl+Alt+F1 login from a terminal and give startx to start Xfce.
This behavior also happens with KDE.

Does anyone know why this is happening?
 
Old 08-11-2018, 03:31 PM   #2
business_kid
LQ Guru
 
Registered: Jan 2006
Location: Ireland
Distribution: Slackware & Android
Posts: 9,477

Rep: Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990
Have you let it sit, come back, and look at top then?
 
Old 08-19-2018, 05:29 PM   #3
Fred Caro
Senior Member
 
Registered: May 2007
Posts: 1,006

Original Poster
Rep: Reputation: 166Reputation: 166
Yes and all appears well until I shutdown top then cpu usage creeps up to the same level. If I leave the system running without top, for say an hour it will be at about 50% and nothing is running apart from Xfce.

I have to leave top running if I want to keep cpu usage at normal levels.


Thanks for reply,

Fred.
 
Old 08-19-2018, 08:01 PM   #4
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 17,162

Rep: Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628
I would be looking very closely for something like a mining malware sneaking around. I'm sure I saw something a while back about one that kept a lookout for things that could monitor it.
Try ps (without top running) and see if anything looks suspect.
 
Old 08-20-2018, 07:15 AM   #5
business_kid
LQ Guru
 
Registered: Jan 2006
Location: Ireland
Distribution: Slackware & Android
Posts: 9,477

Rep: Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990
Another sneaky trick is to copy top to a different name
Code:
cp top chrome
Then run "chrome"
 
Old 08-20-2018, 06:18 PM   #6
Fred Caro
Senior Member
 
Registered: May 2007
Posts: 1,006

Original Poster
Rep: Reputation: 166Reputation: 166
Thanks for replies, will try your suggestions.

I assume you can change top back to top again afterwards!

I don't suppose you have any idea what I might be looking for as suspicious as I doubt it will show up as "Red Dwarf Mining Corp"?
 
Old 08-20-2018, 07:38 PM   #7
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 17,162

Rep: Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628
- you never know, you might get lucky.
Maybe just run ps with and without top running, then diff the lists.
 
1 members found this post helpful.
Old 08-22-2018, 04:11 AM   #8
Fred Caro
Senior Member
 
Registered: May 2007
Posts: 1,006

Original Poster
Rep: Reputation: 166Reputation: 166
I did try diff on the 2 ps versions and it did spit out a lot differences, as you would expect really with different cpu usages at specific times.

I could attach all 3 files if that would help but I think the offending process is hiding behind a legitimate process like systemd, systemctl and ibus-x11, all of which have seen extra activity unexpectedly.

I also ran a clamscan on the whole system but all that came up with was an old "Windows" file that had been on there for ages.

I was thinking of reinstalling with Mint 19 and reintroducing a backup of my data, hopefully that won't reintroduce the problem, any thoughts?


Fred.
 
Old 08-22-2018, 04:50 AM   #9
hydrurga
LQ Guru
 
Registered: Nov 2008
Location: Pictland
Distribution: Linux Mint 19 MATE
Posts: 6,235
Blog Entries: 2

Rep: Reputation: 1992Reputation: 1992Reputation: 1992Reputation: 1992Reputation: 1992Reputation: 1992Reputation: 1992Reputation: 1992Reputation: 1992Reputation: 1992Reputation: 1992
Yes, if you can't pinpoint the intruder (if there is one), a clean install sounds like an excellent idea in this case.
 
Old 08-22-2018, 05:18 AM   #10
business_kid
LQ Guru
 
Registered: Jan 2006
Location: Ireland
Distribution: Slackware & Android
Posts: 9,477

Rep: Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990
I might add that if you're introducing your old data, maybe make the files or directories non executable.
 
Old 08-22-2018, 04:07 PM   #11
Fred Caro
Senior Member
 
Registered: May 2007
Posts: 1,006

Original Poster
Rep: Reputation: 166Reputation: 166
Yes, thanks. It might come to that.

I will check but I think the only executable files are the odd script I have done myself unless, of course, they have been altered.

If I make directories non-executable I will be locked out till I reverse that which would be a bit of a pain.

Or I could try the new timeshift service but I suppose it was not really meant these type of events?
 
Old 08-23-2018, 04:55 AM   #12
business_kid
LQ Guru
 
Registered: Jan 2006
Location: Ireland
Distribution: Slackware & Android
Posts: 9,477

Rep: Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990Reputation: 990
I'm not suggesting making the /bin, & /sbin (/usr/bin, /usr/local, /opt, etc) directories non executable, but the datadirectories. Particularly in your home dir. By default directories get 0755, but in files owned by you in your root drive. That means others can ls the files, but not cd into the directories or execute them.
 
Old 08-23-2018, 06:16 AM   #13
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 17,162

Rep: Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628Reputation: 2628
We still haven't seen any evidence of anything. All (me included) are whistling in the dark.
 
Old 08-23-2018, 10:27 AM   #14
Fred Caro
Senior Member
 
Registered: May 2007
Posts: 1,006

Original Poster
Rep: Reputation: 166Reputation: 166
As for evidence, please see attachment, however, this is s bit of a mess and need explaining:

the first bit is the results of netstat and shows an unsolicited connection (pre-top)


the second the results of lsof with a lot of ibus-x11 activity(pre-top)

the third is lsof and has no ibus-x11 activity (post-top)

the last line is netstat again showing no active connection (post-top)

I don't know what ibus-x11 is and there is no manual page for it but then it is not always this that is associated with high cpu usage.

I've had to edit the file so that it of the permitted size.
 
Old 08-25-2018, 12:15 PM   #15
Fred Caro
Senior Member
 
Registered: May 2007
Posts: 1,006

Original Poster
Rep: Reputation: 166Reputation: 166
Came to the conclusion that even if there was no malware it should not be doing what it was so I reinstalled with Mint 19 and put my data back on.

All seems to be well.

Thanks for the replies and suggestions.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Squid 3 near 100% cpu usage and high RAM usage piman Linux - Software 1 11-16-2013 03:20 AM
mysql server not responding with high cpu usage and high load avgs landysaccount Linux - Server 2 09-15-2013 04:46 AM
[SOLVED] High CPU load, but low CPU usage (high idle CPU) baffy Linux - Newbie 5 03-13-2013 10:24 AM
High load and high cpu kernel usage enid Linux - Server 8 09-30-2010 04:33 AM
High CPU usage ?! Why? skate Linux - Software 1 04-11-2007 06:55 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Linux Mint

All times are GMT -5. The time now is 12:49 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration