[kpzani]

I am running RH8 on a basic spec PC. Celeron 500Mhz 512 Mb, cheap VGA card 8Mb or so. Acting as a PDC on a win xp network with samba.

also a dns server with Bind. Always logged into Gnome. with out a screen saver.

I have noticed varying levels of performance but sometimes the network is really slow. So i ran system monitor and sat there with a cup of coffee.

My CPU load is always between 100 and 104%. RAM is at 70-90% with no use of my swap partition.

Is this normal? My PC at home installed from the same disks but a far superior spec runs at a much lower level.

on inspection of the processes xinted seems to be using the most followed by system monitor (which is not helpful!).

Question. is it normal to not use the swap partition till the RAM is full?
Is the processor so loaded coz its low spec?
Or is it my installation?

Also. I use the service GUI to set services to start on startup does this edit my startup scripts or do something else to start the daemons?

[wassy121]

okay, it is acting as a PDC for how many computers? If it is more than like 5 computers and/or there is heavy traffic I bet inetd is eating a lot of time just spawning tasks, where smbd/nmbd would be better run as daemons (i.e. from an init script). What distro is this anyway? ram is supposed to fill up before even touching swap, that is correct. Swap is just used for extra ram basically. But it is slower, so you try not to use it as much as possible.

[Dolda2000]

Uhmm... wassy, he did say RH8...
smbd and nmbd do run as daemon by default in RH.
But really, kpzani, how can you call a 500 MHz CPU low spec? It should suffice more than well. One thing is clear; the CPU should really not be running at 100%. Check /var/log/secure to find out what xinetd is spawning all of the time. Also check /var/log/messages to see if there is anything anomalous.

[kpzani]

I read the contents of /var/messages and /var/secure as instructed. messages contained nothing that I recognised as strange.

the secure logs contained the following:
************************************************** **
/var/log/secure
Mar 11 16:08:42 server sshd[609]: Received signal 15; terminating.
Mar 12 09:03:53 server sshd[628]: Server listening on 0.0.0.0 port 22.

/var/log/secure.1
Mar 3 14:21:37 server useradd[8589]: new user: name=cl01$, uid=508, gid=507, home=/dev/null, shell=/bin/false

/var/log/secure.2
Feb 27 14:43:01 server sshd[610]: Server listening on 0.0.0.0 port 22.
Feb 27 14:46:02 server xinetd[624]: START: sgi_fam pid=908 from=<no address>
Feb 27 14:49:45 server xinetd[624]: START: sgi_fam pid=1016 from=<no address>
Feb 27 14:54:23 server sshd[610]: Received signal 15; terminating.
Feb 27 15:03:55 server sshd[604]: Server listening on 0.0.0.0 port 22.
Feb 27 15:04:31 server xinetd[618]: START: sgi_fam pid=865 from=<no address>
Feb 28 09:53:32 server useradd[12452]: new user: name=DOMINO$, uid=505, gid=507, home=/dev/null, shell=/bin/false
Feb 28 14:45:20 server useradd[12655]: new user: name=KAZ$, uid=506, gid=507, home=/dev/null, shell=/bin/false
Feb 28 14:56:13 server useradd[12768]: new user: name=KPZ$, uid=507, gid=507, home=/dev/null, shell=/bin/false
Feb 28 16:54:28 server sshd[604]: Received signal 15; terminating.
Mar 1 15:44:53 server sshd[609]: Server listening on 0.0.0.0 port 22.
***********************************************
Does this make any sense? The new user stuff is me adding xp machine trust accounts for samba. But the rest of it although meaningless does not seem strange.

[kpzani]

I also ran top as gnome system monitor was a little resource hungry. The results were as follows
************************************************** *****************
[H[2J[H[1m 2:26pm up 21 min, 1 user, load average: 1.30, 1.29, 0.99
71 processes: 69 sleeping, 2 running, 0 zombie, 0 stopped
CPU states: 94.6% user, 3.1% system, 0.0% nice, 2.1% idle
Mem: 513928K av, 140888K used, 373040K free, 0K shrd, 14300K buff
Swap: 1076344K av, 0K used, 1076344K free 64612K cached
[0m
[7m PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND[0m
643 root 25 0 712 712 604 R 92.6 0.1 17:55 xinetd
1409 root 15 0 1024 1024 832 R 4.7 0.1 0:00 top
887 zeus 16 0 5268 5268 1952 S 0.9 1.0 0:01 gconfd-2
1 root 15 0 476 476 424 S 0.0 0.0 0:04 init
2 root 15 0 0 0 0 SW 0.0 0.0 0:00 keventd
3 root 15 0 0 0 0 SW 0.0 0.0 0:00 kapmd
4 root 34 19 0 0 0 SWN 0.0 0.0 0:00 ksoftirqd_CPU0
5 root 15 0 0 0 0 SW 0.0 0.0 0:00 kswapd
6 root 25 0 0 0 0 SW 0.0 0.0 0:00 bdflush
7 root 15 0 0 0 0 SW 0.0 0.0 0:00 kupdated
8 root 25 0 0 0 0 SW 0.0 0.0 0:00 mdrecoveryd
12 root 15 0 0 0 0 SW 0.0 0.0 0:00 kjournald
67 root 16 0 0 0 0 SW 0.0 0.0 0:00 khubd
156 root 19 0 0 0 0 SW 0.0 0.0 0:00 scsi_eh_0
163 root 15 0 0 0 0 SW 0.0 0.0 0:00 kjournald
164 root 15 0 0 0 0 SW 0.0 0.0 0:00 kjournald
165 root 16 0 0 0 0 SW 0.0 0.0 0:00 kjournald
166 root 16 0 0 0 0 SW 0.0 0.0 0:00 kjournald
454 root 15 0 536 536 456 S 0.0 0.1 0:00 syslogd
458 root 15 0 428 428 376 S 0.0 0.0 0:00 klogd
475 rpc 15 0 532 532 460 S 0.0 0.1 0:00 portmap
494 rpcuser 16 0 724 724 636 S 0.0 0.1 0:00 rpc.statd
612 named 15 0 2764 2764 2008 S 0.0 0.5 0:00 named
629 root 16 0 1464 1464 1220 S 0.0 0.2 0:00 sshd
658 lp 15 0 1204 1204 1020 S 0.0 0.2 0:00 lpd
678 root 15 0 2260 2260 1656 S 0.0 0.4 0:00 sendmail
688 smmsp 18 0 2048 2044 1556 S 0.0 0.3 0:00 sendmail
698 root 15 0 428 428 380 S 0.0 0.0 0:00 gpm
707 root 15 0 612 612 536 S 0.0 0.1 0:00 crond
738 xfs 15 0 3252 3252 880 S 0.0 0.6 0:00 xfs
747 root 16 0 1808 1808 1620 S 0.0 0.3 0:01 smbd[J[6;1H[38;1H

************************************************** ***************

Does this seem strange?
What is sshd?
Any advice on where to go next?

Thanks very much for all your help.

Kris

[Dolda2000]

There doesn't seem to be an immediate answer.
Check to see if the strace package is installed, and if it isn't, install it. Then run (as root) this:

strace -ip `cat /var/run/xinetd.pid`

Then post an excerpt here. You'll have to interrupt strace manually.

[wassy121]

also, look through the contents of /etc/inetd.conf to see what kind of services are being run through inetd. If there are a bunch of services that you use on a minute-to-minute basis then that might be the issue.

[kpzani]

Wassy - I don't have an /etc/inetd.conf file nor do I have one anywhere on the machine - at least not one I can find using a search.
- Question is there a good command line search tool as opposed to the gnome gui which I use currently.

Dolda - Tried running
strace -ip cat /var/run/xinetd.pid
and it errored - but have just noticed the single quotes that you used so I'll try again. When you say interupt manually do you mean kill the process. If not please tell me how.

Thought I'd be clever and work out what you wanted me to do. So I did
ps -ef | grep xinetd
to find the pid? of the xinetd process and then ran
strace -ip 633 (or whatever the id was)

And it did nothing so I killed the terminal.

I examined my xinetd .conf which says very little except include xinetd.d so I opened that folder and found a few config files most of which are disabled. I deleted two which I had created for samba netbios-blah. Before I found I could activate samba from the gnome services GUI.

As an aside: network traffic very low only when users are actually doing something. But initalising the linux printer takes ages from a windows box or locally.

CPU got to 104% today - that's pretty impressive! opened open office word took 7 minutes to launch. Not the best advertisment for dumping MS. Although this takes a while to open the first time on my home machine as well.

Anyway, any more ideas? Please keep trying. Its really bloody annoying!

[Dolda2000]

I think wassy really meant /etc/xinetd.conf. For locating files from the shell, use locate. That's what the GNOME utility uses.

You did exactly what I wanted. Just so that you know, those weren't single quotes, they were "backticks", produced by the key that you combine with shift to produce a tilde (~).
Anyway, are you sure it did _nothing_ at all? It should at least have output something, like "select(1024, [3 4 5 6], NULL, NULL, NULL" or something like that. With interrupting the process manually, I was referring to pressing CTRL+C.

[kpzani]

Tried strace again still did nothing - waited for 10 mins. Command works though tried on home machine and got stuff. Also tried strace -ip on the pid for top which I ran in a separate terminal and got loads of results.

So command works but not happening with xinetd. Question: does this mean xinetd is not doing anything or is it doing so much that strace can't get any processor time or attach itself to the xinetd process.

Any other ideas?

Thanks for the backtick thing. On UK kayboard its top left below [Esc] to left of [1] and also generates [¬] and [¦]. In case you have nothing better to do than find out about international keyboard layouts!

Gonna keep tweaking stuff and hope nothing breaks with a bit of luck I will crack it using the trial and error method.

Cheers

Kris