Linux Virus? Memory used keeps increasing

[SreenadhJonnavithula]

Hello all,

I have a weird problem that I'm hoping I can get some help on.

I am running SuSe 8.2 (Linux 2.4.27)(yes, I know it is old) on Pentium
4 Xeon system; The hardware is 64bit, but for some valid reasons, we
installed a 32 bit OS, and it has been working fine for several (~3)
years now. There is 4GB memory installed; I use the KDE window manager.

Over the last week or so, I see the memory used just keep increasing
even with no user programs running other than firefox and thunderbird.
Periodic "top" commands during the day produce

Mem: 4063012k total, 1855232k used, 2207780k free, 394888k buffers
Mem: 4063012k total, 2181272k used, 1881740k free, 389276k buffers
Mem: 4063012k total, 2211484k used, 1851528k free, 388772k buffers
Mem: 4063012k total, 2250892k used, 1812120k free, 386556k buffers
Mem: 4063012k total, 2818944k used, 1244068k free, 339292k buffers
Mem: 4063012k total, 2969964k used, 1093048k free, 331772k buffers
Mem: 4063012k total, 3600012k used, 463000k free, 317100k buffers

So the memory is slowly being used up, and after about 36 hours, I
have to reboot because everything slows down. In "top", if I do a
shift+m to show memory usage, nothing significant shows up (eg. at the
last one, I have

top - 08:04:13 up 1 day, 15:51, 10 users, load average: 0.00, 0.00, 0.00
Tasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie
Cpu(s): 1.2% user, 0.2% system, 0.0% nice, 98.7% idle
Mem: 4063012k total, 3600012k used, 463000k free, 317100k buffers
Swap: 2097640k total, 0k used, 2097640k free, 2641572k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ Command
1858 root 14 0 98932 33m 2536 S 2.3 0.8 10:45.80 X
7377 sreen 9 0 23608 23m 4676 S 0.0 0.6 0:22.86 xemacs
4417 sreen 9 0 18084 17m 15m S 0.0 0.4 0:38.56 kdeinit
4419 sreen 9 0 15940 15m 12m S 0.0 0.4 0:23.25 kdeinit
4445 sreen 9 0 14492 14m 12m S 0.0 0.4 0:02.66 kdeinit
4593 sreen 9 0 14456 14m 12m S 0.0 0.4 0:00.41 kdeinit
4446 sreen 9 0 14220 13m 12m S 0.0 0.3 0:02.73 kdeinit


Several questions!

Obviously, How Do I Fix This?! (we're about to try reinstalling the OS)

But more interestingly, how does "top" get its information i.e why
does the total show the extra memory when the processes don't?

Or is this a hardware problem? Does Linux have some kind of memory
watcher which marks off bad memory which disappears from the system,
but is not assigned to any process?

Any help appreciated ... thanks

Sreenadh

[khafa]

Hello all,
Several questions!

Obviously, How Do I Fix This?! (we're about to try reinstalling the OS)

can't tell yet

But more interestingly, how does "top" get its information i.e why
does the total show the extra memory when the processes don't?

process-information-gathering tools generally get their information from the /proc filesystem(which is a mapping of your RAM ).

Or is this a hardware problem? Does Linux have some kind of memory
watcher which marks off bad memory which disappears from the system,
but is not assigned to any process?
Sreenadh

Linux caches available RAM for better performance(this does not explain the fact that you system is getting slow though). you can check this with the free command. if you could run the following commands before you reboot your system(after the 36h) and output the results that would help people try to diagnose.

free -m

vmstat 1 5

top n1 i b

[i92guboj]

Mem: 4063012k total, 3600012k used, 463000k free, 317100k buffers
Swap: 2097640k total, 0k used, 2097640k free, 2641572k cached

The thing is this way: you have 4gb ram, 2.64 gb is cached, 0.31 is buffered, 0.46k is free. That makes 3.41 gb of freem ram (roughly since I rounded 1mb=1000 instead of 1024), pretty much a normal thing if you run firefox.

There's nothing wrong with your ram.

[SreenadhJonnavithula]

Thank you, gentlemen, for all your answers. I wanted to wait till my machine was "full" again to try out everything suggested.

Memory was being cached, and showing up in the used column in top. I jumped on this as the cause of an unrelated slowdown. So THERE IS NO PROBLEM WITH MEMORY, and no virus!

Results of my "assignments"
102 sreen linux8 >free -m
total used free shared buffers cached
Mem: 3967 3716 250 0 304 2773
-/+ buffers/cache: 639 3328
Swap: 2048 0 2048

104 sreen linux8 >vmstat 1 5
procs -----------memory---------- ---swap-- -----io---- --system-- ----cpu----
r b swpd free buff cache si so bi bo in cs us sy id wa
0 0 0 256968 312044 2839656 0 0 4 10 99 54 2 0 98 0
0 0 0 256964 312044 2839656 0 0 0 56 178 573 3 0 97 0
0 0 0 256964 312044 2839656 0 0 0 0 167 520 1 0 99 0
0 0 0 256964 312044 2839656 0 0 0 0 173 543 1 0 99 0
0 0 0 256968 312044 2839656 0 0 0 0 168 542 1 0 99 0

105 sreen linux8 >top n1 i b
top - 08:24:12 up 2 days, 18 min, 12 users, load average: 0.06, 0.08, 0.02
Tasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie
Cpu(s): 2.0% user, 0.4% system, 0.0% nice, 97.7% idle
Mem: 4063012k total, 3806212k used, 256800k free, 312044k buffers
Swap: 2097640k total, 0k used, 2097640k free, 2839656k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ Command
1662 sreen 16 0 816 816 604 R 1.0 0.0 0:00.02 top

I also wrote a quick program which keeps malloc'ing in a loop to see when memory would run out, as a sanity check.

int main()
{
int *junk[50000];
int INTSIZE=sizeof(int);
float memsum=0;
int chunk=100000;
int i;

for (i=0;i<50000;i++){
junk[i]=malloc(INTSIZE*chunk);
if(junk[i] == NULL){
printf("Memory limit reached, allocated %f bytes\n",memsum);
exit (1);
}
memsum=memsum+INTSIZE*chunk;
}
printf ("Allocated %f bytes!\n ",memsum);
}


Which gave, when run at this point (i.e with >3GB "used")
Memory limit reached, allocated 3076902400.000000 bytes

So, final proof that 3+ GB is still available to programs.

Once again, thanks for all the input.