UNIX for Dummies Questions & Answers

Hello,

I hope this is an easy question.

I have a few users who login through SSH and some times their bash session is using 100% cpu even though its been "idle" according to who for several days.

I would like to know what command the user ran in their bash session to peg the cpu out but am unsure how to do that.

Any assistance would be appreciated.

To find users processes (This will also show cpu usage for the process):

man ps



use top to view processes you can then sort by the different columns, this will also show who started the process.

Try putting this in /etc/profile

Code:

        TMOUT=14400
        readonly TMOUT
        export TMOUT

If the terminal is idle for 14400 seconds the session ends.

Have you tired lsof to see if there is a script being run?

Hi,

Thank you both for your replies.

I did do a

Code:

 
ps auxf | cat

and it just showed me that Bash was running and using 100% cpu. It gave me pids and showed the owner but that didnt show me what they did.

I then took that user and ran an lsof but I didnt see any scripts running. Our cpu monitoring didnt start alerting until today, when the session was idle (according to w command) for 10 days

Try this

Code:

lsof -p <pid>

will provide you with lots of information about what this PID is using.

I would suggest attaching a debugger or generate a core file(kill -ABRT) and then analyze it.

or try use gdb/truss/strace/other stack utilities on the process to see where it is spinning.

Thanks everyone for your ideas and advice, it is appreciated.


Im not terribly familiar with strace, I do see that I can do

Code:

strace -p <pid>

to trace through a running process, but I dont see a way to do that with a core dump

The only thing I see regarding a file at all is

Code:

strace -o <file>

which sends the output of strace to a file but nothing that would read in a dump - did I miss an option that is staring me in the face?