| 1 |
Hi! |
| 2 |
|
| 3 |
Я заметил странную вещь: через некоторое время работы значительный объём |
| 4 |
памяти (сейчас около 300MB, но раньше вроде бывало и больше) куда-то девается. |
| 5 |
Для проверки я остановил все процессы и сервисы кроме одной консоли, а |
| 6 |
потом перегрузился так, чтобы загрузилась только эта консоль и сравнил |
| 7 |
разницу по выводу free (к сожалению, я забыл сохранить /proc/meminfo до |
| 8 |
перезагрузки, возможно причина была бы видна там). |
| 9 |
|
| 10 |
# free |
| 11 |
--- до перезагрузки: |
| 12 |
total used free shared buffers cached |
| 13 |
Mem: 8133928 4333624 3800304 3320 79536 3857840 |
| 14 |
-/+ buffers/cache: 396248 7737680 |
| 15 |
Swap: 8388604 0 8388604 |
| 16 |
--- после перезагрузки: |
| 17 |
total used free shared buffers cached |
| 18 |
Mem: 8133928 170700 7963228 3268 34632 46304 |
| 19 |
-/+ buffers/cache: 89764 8044164 |
| 20 |
Swap: 8388604 0 8388604 |
| 21 |
|
| 22 |
Вот список процессов до перезагрузки: |
| 23 |
|
| 24 |
# uname -a |
| 25 |
Linux home 3.15.10-hardened-r1 #1 SMP PREEMPT Sat Oct 25 18:56:23 EEST 2014 x86_64 Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz GenuineIntel GNU/Linux |
| 26 |
# uptime |
| 27 |
07:46:43 up 2 days, 17:32, 1 user, load average: 0.00, 0.02, 0.24 |
| 28 |
# ps axf |
| 29 |
PID TTY STAT TIME COMMAND |
| 30 |
2 ? S 0:00 [kthreadd] |
| 31 |
3 ? S 0:42 \_ [ksoftirqd/0] |
| 32 |
5 ? S< 0:00 \_ [kworker/0:0H] |
| 33 |
7 ? S 0:17 \_ [rcuc/0] |
| 34 |
8 ? S 0:00 \_ [rcub/0] |
| 35 |
9 ? S 1:45 \_ [rcu_preempt] |
| 36 |
10 ? S 0:00 \_ [rcu_sched] |
| 37 |
11 ? S 0:00 \_ [rcu_bh] |
| 38 |
12 ? S 0:00 \_ [migration/0] |
| 39 |
13 ? S 0:00 \_ [watchdog/0] |
| 40 |
14 ? S 0:00 \_ [watchdog/1] |
| 41 |
15 ? S 0:00 \_ [migration/1] |
| 42 |
16 ? S 0:04 \_ [rcuc/1] |
| 43 |
17 ? S 0:04 \_ [ksoftirqd/1] |
| 44 |
18 ? S 0:00 \_ [kworker/1:0] |
| 45 |
19 ? S< 0:00 \_ [kworker/1:0H] |
| 46 |
20 ? S 0:00 \_ [watchdog/2] |
| 47 |
21 ? S 0:00 \_ [migration/2] |
| 48 |
22 ? S 0:04 \_ [rcuc/2] |
| 49 |
23 ? S 0:04 \_ [ksoftirqd/2] |
| 50 |
24 ? S 0:00 \_ [kworker/2:0] |
| 51 |
25 ? S< 0:00 \_ [kworker/2:0H] |
| 52 |
26 ? S 0:00 \_ [watchdog/3] |
| 53 |
27 ? S 0:00 \_ [migration/3] |
| 54 |
28 ? S 0:03 \_ [rcuc/3] |
| 55 |
29 ? S 0:04 \_ [ksoftirqd/3] |
| 56 |
31 ? S< 0:00 \_ [kworker/3:0H] |
| 57 |
32 ? S 0:00 \_ [watchdog/4] |
| 58 |
33 ? S 0:00 \_ [migration/4] |
| 59 |
34 ? S 0:02 \_ [rcuc/4] |
| 60 |
35 ? S 0:00 \_ [ksoftirqd/4] |
| 61 |
37 ? S< 0:00 \_ [kworker/4:0H] |
| 62 |
38 ? S 0:00 \_ [watchdog/5] |
| 63 |
39 ? S 0:00 \_ [migration/5] |
| 64 |
40 ? S 0:02 \_ [rcuc/5] |
| 65 |
41 ? S 0:01 \_ [ksoftirqd/5] |
| 66 |
42 ? S 0:00 \_ [kworker/5:0] |
| 67 |
43 ? S< 0:00 \_ [kworker/5:0H] |
| 68 |
44 ? S 0:00 \_ [watchdog/6] |
| 69 |
45 ? S 0:00 \_ [migration/6] |
| 70 |
46 ? S 0:02 \_ [rcuc/6] |
| 71 |
47 ? S 0:01 \_ [ksoftirqd/6] |
| 72 |
48 ? S 0:00 \_ [kworker/6:0] |
| 73 |
49 ? S< 0:00 \_ [kworker/6:0H] |
| 74 |
50 ? S 0:00 \_ [watchdog/7] |
| 75 |
51 ? S 0:00 \_ [migration/7] |
| 76 |
52 ? S 0:02 \_ [rcuc/7] |
| 77 |
53 ? S 0:01 \_ [ksoftirqd/7] |
| 78 |
54 ? S 0:00 \_ [kworker/7:0] |
| 79 |
55 ? S< 0:00 \_ [kworker/7:0H] |
| 80 |
56 ? S< 0:00 \_ [khelper] |
| 81 |
57 ? S 0:00 \_ [kdevtmpfs] |
| 82 |
58 ? S< 0:00 \_ [netns] |
| 83 |
205 ? S 0:00 \_ [khungtaskd] |
| 84 |
207 ? S< 0:00 \_ [writeback] |
| 85 |
214 ? SN 0:06 \_ [khugepaged] |
| 86 |
219 ? S< 0:00 \_ [bioset] |
| 87 |
220 ? S< 0:00 \_ [crypto] |
| 88 |
223 ? S< 0:00 \_ [kblockd] |
| 89 |
541 ? S< 0:00 \_ [ata_sff] |
| 90 |
548 ? S 0:00 \_ [khubd] |
| 91 |
558 ? S< 0:00 \_ [edac-poller] |
| 92 |
662 ? S< 0:00 \_ [kvm-irqfd-clean] |
| 93 |
807 ? S 0:08 \_ [kswapd0] |
| 94 |
809 ? S 0:00 \_ [fsnotify_mark] |
| 95 |
810 ? S< 0:00 \_ [cifsiod] |
| 96 |
833 ? S< 0:00 \_ [pencrypt] |
| 97 |
835 ? S< 0:00 \_ [pdecrypt] |
| 98 |
898 ? S< 0:00 \_ [acpi_thermal_pm] |
| 99 |
1018 ? S 0:00 \_ [scsi_eh_0] |
| 100 |
1019 ? S< 0:00 \_ [scsi_tmf_0] |
| 101 |
1023 ? S 0:00 \_ [scsi_eh_1] |
| 102 |
1024 ? S< 0:00 \_ [scsi_tmf_1] |
| 103 |
1027 ? S 0:00 \_ [scsi_eh_2] |
| 104 |
1028 ? S< 0:00 \_ [scsi_tmf_2] |
| 105 |
1031 ? S 0:00 \_ [scsi_eh_3] |
| 106 |
1032 ? S< 0:00 \_ [scsi_tmf_3] |
| 107 |
1034 ? S 0:00 \_ [scsi_eh_4] |
| 108 |
1036 ? S< 0:00 \_ [scsi_tmf_4] |
| 109 |
1037 ? S 0:00 \_ [scsi_eh_5] |
| 110 |
1039 ? S< 0:00 \_ [scsi_tmf_5] |
| 111 |
1047 ? S 0:00 \_ [scsi_eh_6] |
| 112 |
1048 ? S< 0:00 \_ [scsi_tmf_6] |
| 113 |
1057 ? S 0:00 \_ [scsi_eh_7] |
| 114 |
1058 ? S< 0:00 \_ [scsi_tmf_7] |
| 115 |
1063 ? S 0:00 \_ [scsi_eh_8] |
| 116 |
1065 ? S< 0:00 \_ [scsi_tmf_8] |
| 117 |
1072 ? S 0:00 \_ [scsi_eh_9] |
| 118 |
1073 ? S< 0:00 \_ [scsi_tmf_9] |
| 119 |
1086 ? S 0:02 \_ [kworker/1:1] |
| 120 |
1114 ? S 0:01 \_ [kworker/3:2] |
| 121 |
1115 ? S 0:03 \_ [kworker/4:1] |
| 122 |
1449 ? S< 0:00 \_ [deferwq] |
| 123 |
1477 ? S< 0:07 \_ [kworker/0:1H] |
| 124 |
1478 ? S 0:02 \_ [kworker/2:1] |
| 125 |
1487 ? S 0:01 \_ [kworker/7:1] |
| 126 |
1505 ? S 0:01 \_ [kworker/5:1] |
| 127 |
1506 ? S 0:07 \_ [jbd2/sda5-8] |
| 128 |
1507 ? S< 0:00 \_ [ext4-rsv-conver] |
| 129 |
1532 ? S 0:01 \_ [kworker/6:1] |
| 130 |
1549 ? S 0:00 \_ [kworker/4:2] |
| 131 |
1563 ? S< 0:00 \_ [kworker/6:1H] |
| 132 |
1577 ? S< 0:00 \_ [kworker/2:1H] |
| 133 |
1579 ? S< 0:00 \_ [kworker/1:1H] |
| 134 |
1643 ? S< 0:00 \_ [kworker/5:1H] |
| 135 |
1655 ? S< 0:00 \_ [iprt] |
| 136 |
1659 ? S< 0:00 \_ [kworker/7:1H] |
| 137 |
1681 ? S 0:00 \_ [jbd2/sda6-8] |
| 138 |
1682 ? S< 0:00 \_ [ext4-rsv-conver] |
| 139 |
1686 ? S 0:00 \_ [jbd2/sda8-8] |
| 140 |
1687 ? S< 0:00 \_ [ext4-rsv-conver] |
| 141 |
1914 ? S< 0:00 \_ [kworker/4:1H] |
| 142 |
2747 ? S< 0:00 \_ [kworker/3:1H] |
| 143 |
1113 ? S 0:00 \_ [kworker/3:1] |
| 144 |
11616 ? S 0:01 \_ [kworker/u16:2] |
| 145 |
6433 ? S 0:03 \_ [kworker/u16:1] |
| 146 |
27043 ? S 0:00 \_ [kworker/0:1] |
| 147 |
29191 ? S 0:00 \_ [kworker/0:0] |
| 148 |
22746 ? S 0:00 \_ [kworker/0:2] |
| 149 |
1 ? Ss 0:03 runit |
| 150 |
1791 ? Ss 0:02 runsvdir -P /var/service log: ........................................................................................................................................................................................................................................................................................................................................................................................................... |
| 151 |
1797 ? Ss 0:00 \_ runsv agetty-tty1 |
| 152 |
1873 tty1 Ss 0:00 \_ /bin/login -- |
| 153 |
29069 tty1 S 0:00 \_ -bash |
| 154 |
22770 tty1 R+ 0:00 \_ /bin/ps axf |
| 155 |
|
| 156 |
Теоретически утечка ещё может быть в модулях ядра, но lsmod до |
| 157 |
перезагрузки я тоже забыл сделать, а после вот: |
| 158 |
|
| 159 |
# lsmod |
| 160 |
Module Size Used by |
| 161 |
vboxnetadp 19086 0 |
| 162 |
vboxnetflt 16322 0 |
| 163 |
vboxdrv 1809597 2 vboxnetadp,vboxnetflt |
| 164 |
nvidia_uvm 42587 0 |
| 165 |
nvidia 11013337 31 nvidia_uvm |
| 166 |
|
| 167 |
Других модулей (читай - руткитов) добавиться в процессе работы не могло - |
| 168 |
после загрузки системы загрузка новых модулей ядра блокируется через |
| 169 |
sysctl (/proc/sys/kernel/modules_disabled). |
| 170 |
|
| 171 |
Есть идеи чем это может быть вызвано и на что ещё обратить внимание в |
| 172 |
следующий раз (кроме lsmod и /proc/meminfo)? |
| 173 |
|
| 174 |
-- |
| 175 |
WBR, Alex. |
Archives