I am trying to determine what these running processes are on a lab machine I'm trying to use. I've run the following to determine the top 5 cpu-using processes:

ps -eo pid,user,pcpu,args | sort -k3 -n -r | head -n5

I get something like:

 3735 xdhmoore 1336 my stuff
25456 otherguy  100 user 3 4 10 1
25455 otherguy  100 user 2 4 10 1
25454 otherguy  100 user 1 4 10 1
 7181 root     11.0 antivirus stuff

I'm trying to figure out what user 3 4 10 1 means in the args field. I don't seem to have a user command available to me, and I'm having trouble finding documentation for one. These are Red Hat Enterprise Linux machines. There are 28 CPUs per machine, so I think that accounts for the pcpu values being >=100. I don't have root access.

who -a shows only me, so I believe this may be vestiges of an old login on the physical machine.

1 Answer 1


When you run ps -eo pid,user,pcpu,args |head -1, you'll see the headings of the ps listing. They are:


In your results, that would mean the otherguy user is running three commands:

  • user 3 4 10 1
  • user 2 4 10 1
  • user 1 4 10 1

Apparently user is simply the name of the command or utility they're running, and the numbers are the command-line arguments for it.

To find the actual binary, you could use the PID of the process you're trying to find information about, and go to the respective /proc/<PID>/ directory as root. For example, if you want to know about process #25454, you could run sudo ls -l /proc/25454/.

You would see cwd as a symbolic link pointing to that process's current working directory, and exe as a link pointing to the actual program that is being executed.

On a lab machine, otherguy might be running some kind of research simulation with several variations, such that the complete set of simulation runs would take days or weeks.

Or alternatively, the processes might be camouflaged coin miners...

If you don't have root access, you should ask your local systems administrator about the processes, and whether otherguy actually has permission to run long-term background processes or not. Without root access, you won't be able to do anything to other users' processes anyway.

  • I don't have root access. I have reached out to the user and am working it from that end. But my question is about what user 3 4 10 1 etc. means when it occurs in the args field on a rhel box. Maybe it it some script they wrote, but I'm asking because it looks like it might be some sort of rhel utility or system process.
    – xdhmoore
    Jun 5, 2021 at 23:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .