What does "user # # # #" mean in "ps -eo args" output?

Question

I am trying to determine what these running processes are on a lab machine I'm trying to use. I've run the following to determine the top 5 cpu-using processes:

ps -eo pid,user,pcpu,args | sort -k3 -n -r | head -n5

I get something like:

 3735 xdhmoore 1336 my stuff
25456 otherguy  100 user 3 4 10 1
25455 otherguy  100 user 2 4 10 1
25454 otherguy  100 user 1 4 10 1
 7181 root     11.0 antivirus stuff

I'm trying to figure out what user 3 4 10 1 means in the args field. I don't seem to have a user command available to me, and I'm having trouble finding documentation for one. These are Red Hat Enterprise Linux machines. There are 28 CPUs per machine, so I think that accounts for the pcpu values being >=100. I don't have root access.

who -a shows only me, so I believe this may be vestiges of an old login on the physical machine.

Answer 1

When you run ps -eo pid,user,pcpu,args |head -1, you'll see the headings of the ps listing. They are:

  PID USER     %CPU COMMAND

In your results, that would mean the otherguy user is running three commands:

• user 3 4 10 1
• user 2 4 10 1
• user 1 4 10 1

Apparently user is simply the name of the command or utility they're running, and the numbers are the command-line arguments for it.

To find the actual binary, you could use the PID of the process you're trying to find information about, and go to the respective /proc/<PID>/ directory as root. For example, if you want to know about process #25454, you could run sudo ls -l /proc/25454/.

You would see cwd as a symbolic link pointing to that process's current working directory, and exe as a link pointing to the actual program that is being executed.

On a lab machine, otherguy might be running some kind of research simulation with several variations, such that the complete set of simulation runs would take days or weeks.

Or alternatively, the processes might be camouflaged coin miners...

If you don't have root access, you should ask your local systems administrator about the processes, and whether otherguy actually has permission to run long-term background processes or not. Without root access, you won't be able to do anything to other users' processes anyway.