process keeps calling itself...

I have 1000+ of these - and it appears the parent process for each I have checked is the same command... not sure what is going on... any ideas?


8012     32605  0.0  0.0 110016  1264 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32610  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32611  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32617  0.0  0.0 110016  1272 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32618  0.0  0.0 110016  1264 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32623  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32625  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32629  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32632  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32635  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32639  0.0  0.0 110016  1272 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32641  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32646  0.0  0.0 110016  1272 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32647  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32653  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32654  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32659  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32661  0.0  0.0 110016  1264 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32665  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32668  0.0  0.0 110016  1264 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32671  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32675  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32677  0.0  0.0 110016  1272 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32682  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32683  0.0  0.0 110016  1264 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32689  0.0  0.0 110016  1272 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32690  0.0  0.0 110016  1272 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32695  0.0  0.0 110016  1264 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32697  0.0  0.0 110016  1264 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32701  0.0  0.0 110016  1264 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32704  0.0  0.0 110016  1272 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32707  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32711  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32713  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32718  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32719  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32725  0.0  0.0 110016  1268 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32726  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32731  0.0  0.0 110016  1264 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32733  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32737  0.0  0.0 110016  1264 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32740  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32743  0.0  0.0 110016  1264 ?        S    01:21   0:00 /bin/csh test -d /usr/lib64/qt-3.3
8012     32747  0.0  0.0 110016  1268 ?        S    01:22   0:00 /bin/csh test -d /usr/lib64/qt-3.3

Open in new window

XetroximynAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David FavorLinux/LXD/WordPress/Hosting SavantCommented:
Using pstree may provide you with the inheritance chain (ancestry) of these processes.

Looks to me like the culprit is pid == 8012, which looks to be the parent of the processes you've listed.
0
XetroximynAuthor Commented:
Thanks!

So to be clear 8012 is the UID running the procs... I was trying to find easy way to show PID and PPID without having to resort to a custom format via the o option.

I was also trying to see if there was a way I could run one command to see the complete process inheritance... I tried pstree though and I just get this...


/root # pstree 32663
test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test───test+
[root@cati.vm.opinionaccess.com] /root # 

Open in new window


Any ideas?  Thanks!
0
XetroximynAuthor Commented:
FYI this seems very similar to my problem but it was not my problem (posting in case it helps someone else)
https://support.ca.com/us/knowledge-base-articles.TEC1711985.html

I tried
pkill test
and
killall test

I even ran these 100 times in a row in a script and it got the count down for a while but it would shoot back up...

Eventually I realized I should do (where 8012 was the uid)
ps aux | grep 8012 | grep -v test
to find any non "test" processes from the user and kill those.  There was a hung process... it was a script, and I suspect the script had problems with mutt which was configured to use gmail to send email, but a password reset was needed... I think somehow that got in this strange loop.  Anyway, killing that process and then another pkill test finally did it.



I fixed this eventual
0
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

David FavorLinux/LXD/WordPress/Hosting SavantCommented:
The pstree output seems to indicate the test script is calling itself infinitely.

Maybe...

Try something like...

ps -p 8012

Open in new window


or

ps auxww | grep 0812 | head

Open in new window

0
XetroximynAuthor Commented:
Thanks!

So to be clear 8012 is the UID not the PID

Also - This is already solved and the processes are stopped.  See my previous post :-)

FYI this seems very similar to my problem but it was not my problem (posting in case it helps someone else)
https://support.ca.com/us/knowledge-base-articles.TEC1711985.html

I tried
pkill test
and
killall test

I even ran these 100 times in a row in a script and it got the countdown for a while but it would shoot back up...

Eventually, I realized I should do (where 8012 was the uid)
ps aux | grep 8012 | grep -v test
to find any non "test" processes from the user and kill those.  There was a hung process... it was a script, and I suspect the script had problems with mutt which was configured to use gmail to send email, but a password reset was needed... I think somehow that got in this strange loop.  Anyway, killing that process and then another pkill test finally did it.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
XetroximynAuthor Commented:
because i figured it out, and posted what I did to fix the issue.  Thanks to David for the help though!! :-)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux

From novice to tech pro — start learning today.