15

This question already has an answer here:

I'm running Ubuntu 13.10 on a laptop. Recently, after waking from sleep, I noticed the computer was quite warm, checked top and discovered 1.00 load average. I shutdown Chrome, various daemons, no effect.

I rebooted and fired up a terminal and checked top again, and watched the load quickly spike to 1.75, and slowly settle down back to around 1.0 - 1.2:

top - 09:49:17 up 36 min,  2 users,  load average: 1.01, 1.10, 1.01
Tasks: 267 total,   1 running, 266 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.9 us,  0.4 sy,  0.0 ni, 98.6 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem:   8069288 total,  2885572 used,  5183716 free,   123652 buffers
KiB Swap:  7711332 total,        0 used,  7711332 free,  1661816 cached

  PID USER      PR  NI  VIRT  RES  SHR S  %CPU %MEM    TIME+  COMMAND                                                                                                                                        
 1420 root      20   0  589m 144m 131m S   3.4  1.8   0:36.49 Xorg                                                                                                                                           
 6233 user1    20   0  986m  83m  31m S   2.7  1.1   0:19.89 chrome                                                                                                                                         
 3708 user1    20   0  749m  19m  12m S   1.8  0.3   0:06.58 gnome-terminal                                                                                                                                 
 3526 user1    20   0 1350m  67m  28m S   1.4  0.9   0:26.19 compiz                                                                                                                                         
 4014 user1    20   0 1022m 126m  52m S   1.1  1.6   0:44.34 chrome                                                                                                                                         

I checked /proc/loadavg manually, same story:

sudo cat /proc/loadavg
1.20 1.16 0.99 3/614 6254

ps auxwwwf doesn't show any process consuming more than 6.0% of CPU.

iostat:

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           0.63    0.00    0.13    0.00    0.00   99.25

Device:         rrqm/s   wrqm/s     r/s     w/s    rkB/s    wkB/s avgrq-sz avgqu-sz   await r_await w_await  svctm  %util
sda               0.00     0.00    0.00    0.00     0.00     0.00     0.00     0.00    0.00    0.00    0.00   0.00   0.00
scd0              0.00     0.00    0.00    0.00     0.00     0.00     0.00     0.00    0.00    0.00    0.00   0.00   0.00

free -m:

             total       used       free     shared    buffers     cached
Mem:          7880       2841       5039          0        120       1651
-/+ buffers/cache:       1068       6811
Swap:         7530          0       7530

Clearly some process is saturating CPU, but it doesn't seem to show up on the process list. Some sort of hidden Linux filesystem checker? Rootkit? Any ideas how to find the process in question?

marked as duplicate by Patrick, Thomas Nyman, slm, Ramesh, Braiam May 19 '14 at 18:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from serverfault.com May 19 '14 at 14:06

This question came from our site for system and network administrators.

18

Load average doesn't mean what you think it means. It's not about instant CPU usage, but rather how many processes are waiting to run. Usually that's because of lots of things wanting CPU, but not always. A common culprit is a process waiting for IO - disk or network.

Try running ps -e v and looking for process state flags.

state    The state is given by a sequence of characters, for example, "RWNA". The      first character indicates the run state of the process:
D    Marks a process in disk (or other short term, uninterruptible) wait.
I    Marks a process that is idle (sleeping for longer than about 20 seconds).  
L    Marks a process that is waiting to acquire a lock.
R    Marks a runnable process.
S    Marks a process that is sleeping for less than about 20 seconds.
T    Marks a stopped process.
W    Marks an idle interrupt thread.
Z    Marks a dead process (a "zombie").

This is from the ps manpage, so you can find more detail there - R and D processes are probably of particular interest.

Not the answer you're looking for? Browse other questions tagged or ask your own question.