<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
Typically, anything that hides itself from "ps" is malicious and not part of the system. And the fact that its continuing to run and eating up the CPU also points to something not working right, or not part of the system. There are some RPM commands that can be used to see if the files in a package are still original, or have been modified. I don't remember them off the top of my head, since I haven't had to check for a break-in for a while - but they're there.
<br />
<br />But I'm curious Dirk - how do you know its updatedb that is eating up the processor, if it is hiding itself from ps? Is it showing up in top?
<br />
<br />
<br />In the past, I've also had problems with updatedb eating up a lot of processor time and not completing. It was mostly under BlueQuartz - but of course, BlueOnyx is a "mostly the same scripts child". I found that most times - a "dbrecover stop" and "dbrecover start" solves the problem. But if not - I issue the "dbrecover stop" command, delete the db files in /var/db, and then "dbrecover start" - the databases are rebuilt and usually this solves the problem. Be careful with that last one though - just move the db files somewhere else instead of deleting. That way - if you have a problem, you can put them back.
<br />
<br />
<br />
<br />Chuck
<br />
<br /><font size="2"><b>---------- Original Message
-----------</b>
<br />
From: Dirk Estenfeld <dirk.estenfeld@bpanet.de>
<br />
To: BlueOnyx General Mailing List <blueonyx@mail.blueonyx.it>
<br />
Sent: Wed, 22 Jan 2014 15:42:07 +0000
<br />
Subject: [BlueOnyx:14296] Re: updatedb strange behavior
<br />
<br />> Hello Gerald,
<br />>
<br />>
thank you and Steven for your mails.
<br />>
But I do not need a how-to about ps or updated. I know what the commands is
doing ;)
<br />>
I am wondering why since 21.01., 22.00 (german time) this process is running at
100% at several (!) servers and why I cannot see the process with ps.
<br />>
<br />>
Is nobody experiencing the same issue?
<br />>
<br />>
Reards,
<br />>
Dirk
<br />>
<br />>
-----------------------------------------------
<br />>
Black Point Arts Internet Solutions GmbH - Hanauer Landstrasse 423a - 60314
Frankfurt
<br />>
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@mail.blueonyx.it
<br />>
<a target="_blank" href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>