topic Re: High load average & a root d3 process in Operating System - HP-UX

High load average & a root d3 process

SandiC — Fri, 19 Mar 2010 17:34:28 GMT

What is the d3 or d3 _slave process? I haven't noticed this before but today it's showing up as my top process under the user root & my load averages are unusually high for the number of users I have on the system.

Thanks in Advance!
SandiC

Re: High load average & a root d3 process

John Guster — Fri, 19 Mar 2010 17:47:43 GMT

what is your OS? what is its PPID?

Re: High load average & a root d3 process

SandiC — Fri, 19 Mar 2010 17:54:54 GMT

Sorry for leaving that out! Running HPUX 11.31 on a rp4440 pa-risc. The ppid is showing 1232 for all of them. Could this be from a remote login that was dropped?

Re: High load average & a root d3 process

John Guster — Fri, 19 Mar 2010 18:22:07 GMT

do ps -ef|grep 1232 to see what is the command associate with.

Re: High load average & a root d3 process

SandiC — Fri, 19 Mar 2010 18:33:44 GMT

He # ps -ef|grep 1232
root 1232 1 0 Jan 24 ? 1:23 /usr/sbin/inetd
root 4488 29527 0 14:38:35 ttyp4 0:00 grep 1232
root 2374 1232 0 Jan 24 ? 0:00 /etc/opt/resmon/lbin/registrar
root 27348 1232 0 10:25:23 ? 0:00 -d3
root 20127 1232 0 09:30:34 ? 0:00 -d3
root 17309 1232 0 09:13:30 ? 0:00 -d3
root 28205 1232 0 13:57:14 ? 0:00 -d3
root 26099 1232 0 13:43:13 ? 0:00 -d3
root 3947 1232 0 14:35:37 ? 0:00 -d3
root 11251 1232 0 08:42:01 ? 0:00 -d3
root 11362 1232 0 08:42:29 ? 0:00 -d3
root 18244 1232 0 09:19:01 ? 0:00 -d3
root 8167 1232 0 08:17:27 ? 0:00 -d3
root 28639 1232 0 14:00:05 ? 0:00 -d3
root 22681 1232 0 13:18:00 ? 0:00 -d3
root 23713 1232 0 13:25:12 ? 0:00 -d3
root 19268 1232 0 09:25:54 ? 0:00 -d3
root 6548 1232 0 08:08:43 ? 0:01 -d3
root 17664 1232 0 09:14:39 ? 0:00 -d3
root 7933 1232 0 08:16:43 ? 0:00 -d3
root 9317 1232 0 08:27:10 ? 0:00 -d3
root 15563 1232 0 12:38:26 ? 0:01 -d3
root 21773 1232 0 09:43:14 ? 0:00 -d3
root 1502 1232 0 14:19:25 ? 0:00 -d3
root 19692 1232 0 09:28:15 ? 0:00 -d3
root 7619 1232 0 08:14:51 ? 0:00 -d3
root 16442 1232 0 12:42:56 ? 0:00 -d3
root 13558 1232 0 08:51:59 ? 0:00 -d3
root 14146 1232 0 08:55:12 ? 0:00 -d3
root 10656 1232 0 08:37:07 ? 0:00 -d3
root 8087 1232 0 08:17:05 ? 0:00 -d3
root 3763 1232 255 Jan 31 ? 63414:03 -d3
root 10144 1232 0 08:33:40 ? 0:02 -d3
root 5640 1232 0 08:03:03 ? 0:00 -d3
root 7715 1232 0 08:15:26 ? 0:00 -d3
root 1592 1232 0 14:19:44 ? 0:00 -d3
root 10262 1232 0 08:33:49 ? 0:00 -d3
root 6323 1232 0 08:07:22 ? 0:00 -d3

It looks like whatever it is, it just keeps running today over & over. Is it safe to kill them all?

Re: High load average & a root d3 process

Bill Hassell — Fri, 19 Mar 2010 19:02:24 GMT

This looks like a runaway login attempt where the name of the login shell is d3 (that's why there is a dash -d3 in the listing. Look at the password file:

grep d3 /etc/passwd

It is probably a mistake made by a user trying to create a new shell or menu script and they used the chsh command to change the shell to d3.

Re: High load average & a root d3 process

Bill Hassell — Fri, 19 Mar 2010 19:02:48 GMT

Re: High load average & a root d3 process

John Guster — Fri, 19 Mar 2010 19:05:12 GMT

ps -ef|grep 3762, for an example, you need be sure th eprocess can be killed. this one is very old, find out what it is...maybe a reboot will clear them all.

Re: High load average & a root d3 process

SandiC — Fri, 19 Mar 2010 19:35:15 GMT

System is a trusted one, so looking at passwd gives me nothing. I found one user who has root access that may have accidentally done something, so killed their process but this D3 thing still remains. I guess I'll be doing a reboot on Sunday when I have to install patches anyhow.

Re: High load average & a root d3 process

Bill Hassell — Fri, 19 Mar 2010 20:01:55 GMT

No need to grep anything for ps PID numbers:

ps -fp 1232

You need to track down the parent process (1232). It may have disappeared but I also see registrar with a PPID of 1232. That is part of the EMS/diagnostics reporting system. A reboot will certainly fix this problem.

Whether the system is Trusted, shadow or standard security, you can always read (grep) the passwd file:

grep d3 /etc/passwd

Now if nothing is showing then there is no user shell by that name and the mystery grows deeper. Possibly an option (-d3) was stored as a filename and the parent is trying to automatically start this file. However, the process d3_slave may indicate that this process is associated with something else. Look in the usual places:

find / /usr /opt -xdev -type f | grep d3

The parent directory should give some clue.

Re: High load average & a root d3 process

Bill Hassell — Fri, 19 Mar 2010 20:52:43 GMT

> # ps -ef|grep 1232
> root 1232 1 0 Jan 24 ? 1:23 /usr/sbin/inetd

Oops, I just spotted the first line. PID 1232 is inetd and it has been creating the -d3 processes. Look at /etc/inetd.conf to see if there is a line continuation problem where -d3 is not part of a daemon command line -- but should be.

Re: High load average & a root d3 process

SandiC — Mon, 22 Mar 2010 17:45:28 GMT

Thanks Bill!

Here is a line from the inetd.conf file that may be the culprit:

udssltelnet stream tcp nowait root /usr/ud/bin/udtelnetd -d3

(However it does appear on a single line in the file.) This server hosts a unidata database and I believe the d3 is setting the log level to high; so I'm going to change it to 0,then restart inetd & see if that does it. IF not then I suspect that its something to do with hp services because this is part of what I see when I do the find / /usr/opt -xdev -type f | grep d3:

/opt/hpservices/mqueue/ST00d3_STAT_HP_Services.mot
along with additional lines of ST01d3 through ST07d3.