100% CPU and 100% /home

[zenari]

Hi,
I am running HP-UX 11.11 on a biprocessor machine.
From time to time, a process takes 100% on one CPU and the bdf command displays a full /home partition but the du -s * does not display any large file on that partition.
When I kill this process the /home partition and IDLE CPU parameter return to a normal state (34% on a 15Gb /home partition and CPU IDLE parameter ~99%)
I don't understand why this user process seems to fill /home.
Any help will be appreciated
Regards,
Olivier

[Dieu de Belle Fontaine]

Knock out the user :)
Else what is the application used ?
A simple Oracle Sql program can do that.

B.R.

[Peter Godron]

Hi,
when the program is running use glance to monitor the process. Whilst a process is holding a file the du command may not be able to read its size, so you would not spot it.
Regards

[B. Hulst]

Hi,

Put disk quota on for the user's /home directory.
It saves it from running full by one user's activities.

Regards,
Bob

[Bill Hassell · Accepted solution]

Based on your symptoms, it would seem that the user's (bad) process has created a temporary but hidden file in /home. It's easy to understand why the user process fills /home...it was programmed that way. When the process is terminated, the file is removed. Using hidden filenames is a VERY bad Unix hack on any server. This technique is often found on single user workstations because their code only affects themselves and no one else.

Turn on quotas for /home, or even simpler: Create a small lvol (a few hundred megs) and move the user's /home/user_name directory to this lvol. Then use the empty /home/user_name directory as a mountpoint for the lvol. The user will still see the same /home but it will be on a separate lvol and when it fills up, the user has to deal with it.

Disk space and CPU cycles are a shared resource on a server and a user that consumes massive amounts of resources must be eremoved from the server and placed on a test box. You might also set ulimit -t 20 just for this user (POSIX shell or recently patched ksh). This will terminate the user process when 20 seconds of CPU time has been consumed. However, causal testing shows that this setting does not seem to work.

[Peter Godron]

Hi,
the way to see what files are open for a process and where they are is: Use lsof

http://gatekeep.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.74/

This is a very useful utility, so well worth the download !
Regards