Hidden PIDs

[Danesh Qureshi]

When I run the top command to check the processor activity it displays PIDs and other useful information on my screen. Now when type the ps command I notice that some of the PIDs displayed by top do not appear in ps.

I have attached output of top. The output of top displays PIDs 19533,21416,1594,1595 and 1595.

For some reason ps is not displaying the above PIDs.

Can anyone shed some light on this?

[Steven E. Protter · Accepted solution]

Shalom,


java is a well known resource hog and its using a ton of resources on your system.

java launches individual processes in response to certain application requests and the discrepancy may be due to the fact that the process you are monitoring is closed by the time you get to the ps command.

I suppose the process table is corrupted but your system would not last long in that condition. I don't see anything on the process list that sticks out other than java using a lot of resources and dominating your whole system.

Perhaps you can attach your ps command and output.

Could be you formulated the ps command incorrectly.

SEP

[Stuart Browne]

If you're really worried about hidden processes (which incidentally should not be possible to hide form a super user), you might want to verify your ps binary.

If it's a redhat based system, an 'rpm -V procps' should do that for you, assuming that a 'which ps' returns '/bin/ps'.

[Danesh Qureshi]

Hi,

The HP DL380 G4 server is running RedHat Linux As 3 update 4.

The output of rpm -V procps give me nothing
[root#]

The output which ps see below
[root]# which ps
/bin/ps
[root]#

I have attached a file containing the output of top and the ps -ef.

You will notice the java processes show up in top but not is ps -ef.

I was wondering if this is expected behaviour of RedHat Linux As 3 that processes are hidden from ps but not top.

[Danesh Qureshi]

Sorry forgot to attach the file. here it is.

[Ivan Ferreira]

Maybe the process starts and die very fast, and from the output of ps, you have to check the full path to the java command, not just "java", for example:


root 1593 1561 3 Sep27 ? 01:06:14 /local/bea92/jdk150_08/bin/java -ms1536m -mx1536m -XX:MaxPermSize=192m -XX:NewSize=128m -XX:Ma

You can also try:

ps auxw |grep java

[Danesh Qureshi]

have attached another file containing the output of the top command and you will notice those java PIDs are still running.

See output of ps auwx | grep -i java

[root]# ps auxw | grep -i java
root 1593 3.5 52.3 2496840 2109584 ? S Sep27 70:14 /local/bea92/jdk150_08/bin/java -ms1536m -mx1536m -XX:a
root 10252 0.1 5.4 1529816 218108 ? S Sep27 3:20 /local/bea92/jdk150_08/bin/java -ms128m -mx1024m -XX:N.
root 20427 0.0 0.0 3700 668 pts/3 S 16:14 0:00 grep -i java

[Ivan Ferreira]

I think that is interesting. What is your procps version?

rpm -qi procps

Checking the procps changelog here:

http://procps.sourceforge.net/changelog.html

In Version 3.1.5
serious hidden-process problem (3.1.3+) fixed

Maybe you need to update your procps package.

Also, check if you can find in /proc a directory that corresponds with the hidden processes.

[Danesh Qureshi]

I have attached a file containing output of
rpm -qi procps

I have cd to /proc directory

The interesting thing is when I use ls -l I cannot see those PIDs but when I ls -la I can those PIDs which are also in top.

I have appended the output
of ls -l and ls -la in the attached file to see what I am seeing.

What are your thoughts now?

[Ivan Ferreira]

Investigating a little further, it seems like these "dot directories" in /proc, are threads, and you can display with p-m option of ps, for example, ps auxm