High load average & a root d3 process

[SandiC]

What is the d3 or d3 _slave process? I haven't noticed this before but today it's showing up as my top process under the user root & my load averages are unusually high for the number of users I have on the system.

Thanks in Advance!
SandiC

[John Guster]

what is your OS? what is its PPID?

[SandiC]

Sorry for leaving that out! Running HPUX 11.31 on a rp4440 pa-risc. The ppid is showing 1232 for all of them. Could this be from a remote login that was dropped?

[John Guster]

do ps -ef|grep 1232 to see what is the command associate with.

[SandiC]

He # ps -ef|grep 1232
root 1232 1 0 Jan 24 ? 1:23 /usr/sbin/inetd
root 4488 29527 0 14:38:35 ttyp4 0:00 grep 1232
root 2374 1232 0 Jan 24 ? 0:00 /etc/opt/resmon/lbin/registrar
root 27348 1232 0 10:25:23 ? 0:00 -d3
root 20127 1232 0 09:30:34 ? 0:00 -d3
root 17309 1232 0 09:13:30 ? 0:00 -d3
root 28205 1232 0 13:57:14 ? 0:00 -d3
root 26099 1232 0 13:43:13 ? 0:00 -d3
root 3947 1232 0 14:35:37 ? 0:00 -d3
root 11251 1232 0 08:42:01 ? 0:00 -d3
root 11362 1232 0 08:42:29 ? 0:00 -d3
root 18244 1232 0 09:19:01 ? 0:00 -d3
root 8167 1232 0 08:17:27 ? 0:00 -d3
root 28639 1232 0 14:00:05 ? 0:00 -d3
root 22681 1232 0 13:18:00 ? 0:00 -d3
root 23713 1232 0 13:25:12 ? 0:00 -d3
root 19268 1232 0 09:25:54 ? 0:00 -d3
root 6548 1232 0 08:08:43 ? 0:01 -d3
root 17664 1232 0 09:14:39 ? 0:00 -d3
root 7933 1232 0 08:16:43 ? 0:00 -d3
root 9317 1232 0 08:27:10 ? 0:00 -d3
root 15563 1232 0 12:38:26 ? 0:01 -d3
root 21773 1232 0 09:43:14 ? 0:00 -d3
root 1502 1232 0 14:19:25 ? 0:00 -d3
root 19692 1232 0 09:28:15 ? 0:00 -d3
root 7619 1232 0 08:14:51 ? 0:00 -d3
root 16442 1232 0 12:42:56 ? 0:00 -d3
root 13558 1232 0 08:51:59 ? 0:00 -d3
root 14146 1232 0 08:55:12 ? 0:00 -d3
root 10656 1232 0 08:37:07 ? 0:00 -d3
root 8087 1232 0 08:17:05 ? 0:00 -d3
root 3763 1232 255 Jan 31 ? 63414:03 -d3
root 10144 1232 0 08:33:40 ? 0:02 -d3
root 5640 1232 0 08:03:03 ? 0:00 -d3
root 7715 1232 0 08:15:26 ? 0:00 -d3
root 1592 1232 0 14:19:44 ? 0:00 -d3
root 10262 1232 0 08:33:49 ? 0:00 -d3
root 6323 1232 0 08:07:22 ? 0:00 -d3

It looks like whatever it is, it just keeps running today over & over. Is it safe to kill them all?

[Bill Hassell]

This looks like a runaway login attempt where the name of the login shell is d3 (that's why there is a dash -d3 in the listing. Look at the password file:

grep d3 /etc/passwd

It is probably a mistake made by a user trying to create a new shell or menu script and they used the chsh command to change the shell to d3.

[Bill Hassell]

This looks like a runaway login attempt where the name of the login shell is d3 (that's why there is a dash -d3 in the listing. Look at the password file:

grep d3 /etc/passwd

It is probably a mistake made by a user trying to create a new shell or menu script and they used the chsh command to change the shell to d3.

[John Guster]

ps -ef|grep 3762, for an example, you need be sure th eprocess can be killed. this one is very old, find out what it is...maybe a reboot will clear them all.

[SandiC]

System is a trusted one, so looking at passwd gives me nothing. I found one user who has root access that may have accidentally done something, so killed their process but this D3 thing still remains. I guess I'll be doing a reboot on Sunday when I have to install patches anyhow.

[Bill Hassell]

No need to grep anything for ps PID numbers:

ps -fp 1232

You need to track down the parent process (1232). It may have disappeared but I also see registrar with a PPID of 1232. That is part of the EMS/diagnostics reporting system. A reboot will certainly fix this problem.

Whether the system is Trusted, shadow or standard security, you can always read (grep) the passwd file:

grep d3 /etc/passwd

Now if nothing is showing then there is no user shell by that name and the mystery grows deeper. Possibly an option (-d3) was stored as a filename and the parent is trying to automatically start this file. However, the process d3_slave may indicate that this process is associated with something else. Look in the usual places:

find / /usr /opt -xdev -type f | grep d3

The parent directory should give some clue.