<div dir="ltr">Hi Dirk<div><br></div><div>It appears to be operating normally now after a reboot.<br><div><br></div><div><span style="font-size:12.8px">grep -ir convkep /var/log</span><br></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">produces no output. I also had previously renamed <a href="http://convkep.pl">convkep.pl</a> to something so it would not execute. I assume this matches with the fact that it did not execute.</span></div></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">I can include the output from the rest if you like.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Again, many thanks for your help.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Mike</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Feb 24, 2017 at 8:34 AM, Dirk Koopman via Dxspider-support <span dir="ltr"><<a href="mailto:dxspider-support@dxcluster.org" target="_blank">dxspider-support@dxcluster.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<div class="m_4455527967219438039moz-cite-prefix">Something, somewhere is starting one or
<a href="http://convkeps.pl" target="_blank">convkeps.pl</a> commands. (I am presuming that the ps aux you put up
on your last email on this subject is contemporaneous with the top
you sent). <br>
<br>
First, reboot. then, as root, do:<br>
<br>
1. check that it is behaving normally.<br>
<br>
2. grep -ir convkep /var/log<br>
<br>
if nothing seen<br>
<br>
3. cd /spider; grep -ir convkep .<br>
<br>
If nothing is found.<br>
<br>
4. grep -ir convkep /var/spool/cron<br>
<br>
It has to be started somewhere and we have now covered all the
likely "normal" places.<br>
<br>
5. grep -ir convkep /<br>
<br>
We now start looking of abnormal places, which will take a
while...<br>
<br>
Please let me know. <br>
<br>
Dirk<div><div class="h5"><br>
<br>
On 24/02/17 13:08, Michael Walker via Dxspider-support wrote:<br>
</div></div></div>
<blockquote type="cite"><div><div class="h5">
<div dir="ltr">Something is happening on Thursday nights. Very
strange. There are no cron jobs running and any command takes
over a minute to execute. su
<div><font face="monospace, monospace"><br>
</font></div>
<div><font face="monospace, monospace">Sysop owns many perl
executions. Any thoughts would be appreciated. </font></div>
<div><font face="monospace, monospace"><br>
</font></div>
<div><font face="monospace, monospace">I will look through the
messages log again and see if anything looks unusual.</font></div>
<div><font face="monospace, monospace"><br>
</font></div>
<div><font face="monospace, monospace">Mike va3mw</font></div>
<div><font face="monospace, monospace"><br>
</font></div>
<div><font face="monospace, monospace"><br>
</font>
<div>
<div><font face="monospace, monospace">Tasks: 255 total, 10
running, 189 sleeping, 0 stopped, 56 zombie</font></div>
<div><font face="monospace, monospace">%Cpu(s): 98.5 us,
1.0 sy, 0.0 ni, 0.0 id, 0.0 wa, 0.0 hi, 0.5 si,
0.0 st</font></div>
<div><font face="monospace, monospace">KiB Mem : 1005780
total, 49180 free, 879580 used, 77020 buff/cache</font></div>
<div><font face="monospace, monospace">KiB Swap: 2097148
total, 882880 free, 1214268 used. 14720 avail Mem</font></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div><font face="monospace, monospace"> 5053 sysop 20
0 201608 16100 1896 R 52.7 1.6 75:44.90 perl</font></div>
<div><font face="monospace, monospace"> 5041 sysop 20
0 201448 12660 1936 R 52.4 1.3 69:05.30 perl</font></div>
<div><font face="monospace, monospace"> 5030 sysop 20
0 201448 10080 1928 R 52.1 1.0 87:48.68 perl</font></div>
<div><font face="monospace, monospace"> 3804 sysop 20
0 201448 12256 1820 R 50.8 1.2 1046:30 perl</font></div>
<div><font face="monospace, monospace"> 5003 sysop 20
0 208108 10684 2112 R 50.8 1.1 26:30.76 perl</font></div>
<div><font face="monospace, monospace"> 5043 sysop 20
0 201448 13576 1644 R 49.2 1.3 89:51.83 perl</font></div>
<div><font face="monospace, monospace"> 5061 sysop 20
0 201448 12212 1688 R 44.4 1.2 111:15.19 perl</font></div>
<div><font face="monospace, monospace"> 5064 sysop 20
0 201448 14572 1692 R 43.4 1.4 92:14.72 perl</font></div>
<div><font face="monospace, monospace"> 2498 root 20
0 157792 1092 624 R 1.3 0.1 21:57.25 top</font></div>
<div><font face="monospace, monospace"> 5455 sysop 20
0 157840 2420 1544 R 1.3 0.2 0:01.17 top</font></div>
<div><font face="monospace, monospace"> 2326 sysop 20
0 142972 940 772 S 0.6 0.1 0:07.04 sshd</font></div>
<div><font face="monospace, monospace"> 5035 sysop 20
0 207976 10368 1784 D 0.6 1.0 0:37.05 perl</font></div>
<div><font face="monospace, monospace"> 2421 root 20
0 143104 1252 1020 S 0.3 0.1 2:21.38 sshd</font></div>
<div><font face="monospace, monospace"> 4999 sysop 20
0 210168 11032 1808 D 0.3 1.1 1:07.23 perl</font></div>
<div><font face="monospace, monospace"> 5002 sysop 20
0 210072 14640 2108 D 0.3 1.5 24:47.69 perl</font></div>
<div><font face="monospace, monospace"> 5005 sysop 20
0 204316 9580 1808 D 0.3 1.0 1:22.06 perl</font></div>
<div><font face="monospace, monospace"> 5038 sysop 20
0 203984 9636 1808 D 0.3 1.0 0:38.74 perl</font></div>
<div><font face="monospace, monospace"> 5049 sysop 20
0 201448 9152 1692 D 0.3 0.9 0:11.90 perl</font></div>
<div><font face="monospace, monospace"> 5055 sysop 20
0 201448 10952 1688 D 0.3 1.1 0:24.00 perl</font></div>
</div>
<div><br>
</div>
</div>
</div>
<br>
<fieldset class="m_4455527967219438039mimeAttachmentHeader"></fieldset>
<br>
</div></div><pre>______________________________<wbr>_________________
Dxspider-support mailing list
<a class="m_4455527967219438039moz-txt-link-abbreviated" href="mailto:Dxspider-support@dxcluster.org" target="_blank">Dxspider-support@dxcluster.org</a>
<a class="m_4455527967219438039moz-txt-link-freetext" href="http://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" target="_blank">http://mailman.tobit.co.uk/<wbr>mailman/listinfo/dxspider-<wbr>support</a>
</pre>
</blockquote>
<br>
</div>
<br>______________________________<wbr>_________________<br>
Dxspider-support mailing list<br>
<a href="mailto:Dxspider-support@dxcluster.org">Dxspider-support@dxcluster.org</a><br>
<a href="http://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" rel="noreferrer" target="_blank">http://mailman.tobit.co.uk/<wbr>mailman/listinfo/dxspider-<wbr>support</a><br>
<br></blockquote></div><br></div>