cancel
Showing results for 
Search instead for 
Did you mean: 

Hidden PIDs

 
SOLVED
Go to solution
Highlighted
Regular Advisor

Hidden PIDs

When I run the top command to check the processor activity it displays PIDs and other useful information on my screen. Now when type the ps command I notice that some of the PIDs displayed by top do not appear in ps.

I have attached output of top. The output of top displays PIDs 19533,21416,1594,1595 and 1595.

For some reason ps is not displaying the above PIDs.

Can anyone shed some light on this?



14 REPLIES 14
Highlighted
Exalted Contributor
Solution

Re: Hidden PIDs

Shalom,


java is a well known resource hog and its using a ton of resources on your system.

java launches individual processes in response to certain application requests and the discrepancy may be due to the fact that the process you are monitoring is closed by the time you get to the ps command.

I suppose the process table is corrupted but your system would not last long in that condition. I don't see anything on the process list that sticks out other than java using a lot of resources and dominating your whole system.

Perhaps you can attach your ps command and output.

Could be you formulated the ps command incorrectly.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Highlighted
Honored Contributor

Re: Hidden PIDs

If you're really worried about hidden processes (which incidentally should not be possible to hide form a super user), you might want to verify your ps binary.

If it's a redhat based system, an 'rpm -V procps' should do that for you, assuming that a 'which ps' returns '/bin/ps'.
One long-haired git at your service...
Highlighted
Regular Advisor

Re: Hidden PIDs

Hi,

The HP DL380 G4 server is running RedHat Linux As 3 update 4.

The output of rpm -V procps give me nothing
[root#]

The output which ps see below
[root]# which ps
/bin/ps
[root]#

I have attached a file containing the output of top and the ps -ef.

You will notice the java processes show up in top but not is ps -ef.

I was wondering if this is expected behaviour of RedHat Linux As 3 that processes are hidden from ps but not top.


Highlighted
Regular Advisor

Re: Hidden PIDs

Sorry forgot to attach the file. here it is.
Highlighted
Honored Contributor

Re: Hidden PIDs

Maybe the process starts and die very fast, and from the output of ps, you have to check the full path to the java command, not just "java", for example:


root 1593 1561 3 Sep27 ? 01:06:14 /local/bea92/jdk150_08/bin/java -ms1536m -mx1536m -XX:MaxPermSize=192m -XX:NewSize=128m -XX:Ma

You can also try:

ps auxw |grep java
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
Highlighted
Regular Advisor

Re: Hidden PIDs

have attached another file containing the output of the top command and you will notice those java PIDs are still running.

See output of ps auwx | grep -i java

[root]# ps auxw | grep -i java
root 1593 3.5 52.3 2496840 2109584 ? S Sep27 70:14 /local/bea92/jdk150_08/bin/java -ms1536m -mx1536m -XX:a
root 10252 0.1 5.4 1529816 218108 ? S Sep27 3:20 /local/bea92/jdk150_08/bin/java -ms128m -mx1024m -XX:N.
root 20427 0.0 0.0 3700 668 pts/3 S 16:14 0:00 grep -i java
Highlighted
Honored Contributor

Re: Hidden PIDs

I think that is interesting. What is your procps version?

rpm -qi procps

Checking the procps changelog here:

http://procps.sourceforge.net/changelog.html

In Version 3.1.5
serious hidden-process problem (3.1.3+) fixed

Maybe you need to update your procps package.

Also, check if you can find in /proc a directory that corresponds with the hidden processes.
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
Highlighted
Regular Advisor

Re: Hidden PIDs

I have attached a file containing output of
rpm -qi procps

I have cd to /proc directory

The interesting thing is when I use ls -l I cannot see those PIDs but when I ls -la I can those PIDs which are also in top.

I have appended the output
of ls -l and ls -la in the attached file to see what I am seeing.

What are your thoughts now?

Highlighted
Honored Contributor

Re: Hidden PIDs

Investigating a little further, it seems like these "dot directories" in /proc, are threads, and you can display with p-m option of ps, for example, ps auxm
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?