Shulou(Shulou.com)06/02 Report--

1. Problem found [root@zwlbs3 ~] # top

i. It was found that there was a process whose CPU utilization rate was 700%. The kill command was composed of some random strings and won the bid. The first thought was "sand sculpture". Give it to me with the command.

[root@zwlbs3 ~] # kill-9 "PID"

ii. However, it was found that kill the process was quiet for a while and then started again.

Note: old pictures are reused, PID and COMMAND are all changed.

two。 Check the details of the process [root@zwlbs3 ~] # cd / proc/748/ [root@zwlbs3 748] # ls-ial# "748" is the PID of the process, you can view it according to your PID.

As shown in the figure:

It is found that the process is in the / dev/shm directory. What directory is / dev/shm?

Take a paragraph from the Internet and let's decipher / dev/shm

1) first of all, you can see that / dev/shm is a device file, you can regard / dev/shm as the entry of system memory, you can think of it as a physical storage device, a tmp filesystem, you can read and write files to memory through this device, in order to speed up some high-level operations such as open, write, read for a large file frequently.

2) oracle is said to take advantage of / dev/shm (shitou has not used oracle) and can list the current / dev/shm mounted file systems through the mount command.

3) since it is a memory-based file system, the files under / dev/shm will not exist after the system restart. The size of the Linux default (CentOS) / dev/shm partition is 50% of the system's physical memory, although using / dev/shm is much more efficient for file operations. But at present, it is rarely used in various distribution software (except for the Oracle mentioned earlier). You can check whether there is a file below through ls / dev/shm. If not, it means that the current system is not using the device.

Check the / dev/shm directory for related files.

[root@zwlbs3] # ls-a / dev/shm/. ... # there are no relevant documents, which is strange. Crontab also has no planned tasks. No related files were found using the which command. It is also normal to check the system log, which is very strange. Few files related to the process were found. 3. Solution.

i. View the analysis of thread occupancy within a process

[root@zwlbs3] # top-H-p "PID"

ii. It turns out that there are so many related processes that all kill is dropped.

iii. I checked again in the past few minutes and found that the system load returned to normal.

I thought it was solved, but a few hours later, the examination found it again, damn it.

Due to the inconvenient production environment to restart the server, I had no choice but to try to restart the server.

4. Restart Dafa

One hour after restarting the server, check again that it has returned to normal, so it is better to restart Dafa.

What is the purpose of this malicious program? Why only consume CPU resources? As the relevant document information was not found, the reason is not clear.

If you know, boss, please tell me, thank you very much!

Summary

The above is the whole content of this article. I hope the content of this article has a certain reference and learning value for everyone's study or work. Thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.