topic Re: find and vhand in Operating System - HP-UX

find and vhand

Elena Leontieva — Fri, 21 Jan 2005 13:17:40 GMT

Hi,

When I remove just one user form the system, naturally two 'find' processes get started. Also, vhand jumps on top of 'top' consuming 96% CPU, the system becomes very, very slow, - command prompt comes back, say in 30 sec (!). When removal is completed the system is back to normal.

K460, 2GB RAM, HP-UX 11.00, one Oracle instance is running, no load at all.

I never seen that a simple task of deleting a user account can bring a system to its knees.

Any thoughts?

Thanks,
Elena.

Re: find and vhand

Steven E. Protter — Fri, 21 Jan 2005 13:27:11 GMT

vhand is involved with the dreaded paging of data to swap.

swapinfo -tam

vmstat

You may need more memory or less applications to make this stop happening.

SEP

Re: find and vhand

John Poff — Fri, 21 Jan 2005 13:27:26 GMT

Hi,

Are you using 'sam' to delete the user's account? If so, are you specifying the option to remove the user's files from all local filesystems? That would explain the 'find' processes. You could test the load of the find command by issuing it as root to find all the files from / for a specific user.

JP

Re: find and vhand

harry d brown jr — Fri, 21 Jan 2005 13:45:00 GMT

Of course, if you are doing what John outlined, you risk losing some very critical application files.

live free or die
harry d brown jr

Re: find and vhand

Elena Leontieva — Fri, 21 Jan 2005 14:11:55 GMT

I ran:

find / -name UID -print

this find triggered vhand and the system became very slow again. I interrupted 'find', but vhand was holding the system for about 15 minutes until it vanished from the 'top' screen.

coc461(root):/etc> swapinfo -tam
Mb Mb Mb PCT START/ Mb
TYPE AVAIL USED FREE USED LIMIT RESERVE PRI NAME
dev 2048 120 1928 6% 0 - 1 /dev/vg00/lvol2
reserve - 1927 -1927
memory 1616 347 1269 21%
total 3664 2394 1270 65% - 0 -
coc461(root):/etc> vmstat -S 5 5
procs memory page faults cpu
r b w avm free si so pi po fr de sr in sy cs us sy id
0 0 0 15223 8476 16782 16782 7 2 8 0 4193 1096 505 90 2 2 96
0 0 0 14754 8425 0 0 0 0 6 0 0 1065 541 60 0 0 100
0 0 0 12007 8425 0 0 0 0 0 0 0 1048 250 47 0 0 100
0 0 0 13133 8425 0 0 0 0 0 0 0 1095 332 62 0 0 99
0 0 0 14124 8421 0 0 0 0 0 0 0 1079 504 73 1 1 99

Any ideas?

Re: find and vhand

John Poff — Fri, 21 Jan 2005 14:16:38 GMT

Do you have any filesystems with tens of thousands of files in them, especially in a single directory? The 'find' command would surely bog down in that situation.

JP

Re: find and vhand

Patrick Wallek — Fri, 21 Jan 2005 14:17:30 GMT

Doing a global find (find /) on a system is really not a good idea. It can bring a system to a crawl, and apparently in your case, causes just enough of a load to cause you to start paging out.

Here's what I would do:

1) Don't use sam to delete users and especially don't let it search for users files. Delete the home directory manually.

2) Monitor swapinfo and vmstat and see if you see any page outs.

3) Monitor RAM usage, most easily done with glance.

4) Try to avoid doing 'find /'

If you see a large number of page outs when monitoring vmstat, then it is likely time to add RAM to the machine.

Re: find and vhand

Elena Leontieva — Fri, 21 Jan 2005 14:35:53 GMT

I do not have many file systems and thousands of files, just standard and one NFS mount, but I specified to delete user files from local file systems only, so NFS does not count.

coc461(root):/> bdf
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol3 143360 37864 99005 28% /
/dev/vg00/lvol1 295024 30336 235184 11% /stand
/dev/vg00/lvol8 2097152 1011680 1017666 50% /var
/dev/vg00/lvol7 2097152 873806 1146917 43% /usr
/dev/vg00/lvol6 1048576 626072 397411 61% /tmp
/dev/vg00/lvol5 1228800 794303 408369 66% /opt
/dev/vg00/lvol4 102400 62007 38243 62% /home
cocnetapps02:/vol/vol1
71161808 30866304 40295504 43% /oracle
coc461(root):/>

I am aware that it is not a good idea to run find / , but when needed, I did it on other system, although I've never seen this kind of impact before.

I just have a feeling that this system behaves abnormally (?).