SH process is using 50% of CPU, why is that?

Question

I have CRON running every 30 seconds, but that would fall under the crond process correct? Why is sh command sucking up 50% of my CPU when no one is running a Shell Script?

Answer 1

Cron will run the command specified in the command field using sh -c. You can specify another shell by setting SHELL in the crontab file.

EDIT:

Just to clarify, the sh -c command will be ran as a subprocess of cron, which may spawn other subprocesses depending on the command given.

Answer 2

crond runs as root on every system I'm familiar with:

1016 % ps -ef | grep crond 
root       342     1  0 12:37 ?        00:00:00 /usr/sbin/crond

That's on a fairly current Arch installation, but an elderly Slackware says the same thing. If you as some non-root user puts together a crontab file, crond will run the commands as your non-root user ID. The root ownership has been a cause of several major security problems over the years.

As far as using 50% of a CPU, running something heavyweight every 30 seconds could easily consume 50% of a CPU. Lots of "globbing" could do that, I'd think, as could doing a lot of sh-builtin string pattern matching or arithmetic.