Arch Linux

ien

Member

Registered: 2014-08-06

Posts: 16

Strange root process

Hi,

I was checking out my processes with gnome-system-monitor and I noticed that there was strange empty process run by root atleast once every minute.
I don't have cron installed and there is nothing in systemd timers that would run every minute.
What bugs me is that the process doesn't seem to do anything and it has start time "Thu Jan 1 02:00:00 1970"

Anyone know whats going on or how to identify this process? Some way to log every started process would be nice.

https://i.imgur.com/w8UggeM.png

-- mod edit: read the Forum Etiquette and only post thumbnails http://wiki.archlinux.org/index.php/For … s_and_Code [jwr] --

jasonwryan

Anarchist

From: .nz

Registered: 2009-05-09

Posts: 30,424

Website

Re: Strange root process

You could use lsof and other related tools to discover more about the process.

Not a Sysadmin issue, moving to NC...

---

Arch + dwm   •   Mercurial repos  •   Surfraw

Registered Linux User #482438

ien

Member

Registered: 2014-08-06

Posts: 16

Re: Strange root process

It only pops for a moment, each time with new pid.
I made command to pipe lsof -u root into file every 0.2sec and waited till new pid showed up, but I could not catch it.

Sorry about the image.

Last edited by ien (2014-08-06 19:50:17)

ien

Member

Registered: 2014-08-06

Posts: 16

Re: Strange root process

I tried to install audit, but I can't even get it running and I think its bit over my head anyway,
so I did some thinking and it might be that gnome-system-monitor can't read info of a process run by root,
and thats why it shows wrong start time and info.

Also, process doesn't show up if I run system-monitor as root,
so I guess its just some bug and monitor is trying to show something that it should not.

Trilby

Inspector Parrot

Registered: 2011-11-29

Posts: 29,614

Website

Re: Strange root process

That date is unix time 25200 if you know where that number could be coming from.  It does sound like a monitor bug to me.  With a NULL name, a UID of 0, and most time/date fields as 0, it looks like an empty data structure representing a process was created and with one value set it was displayed.

---

"UNIX is simple and coherent..." - Dennis Ritchie, "GNU's Not UNIX" -  Richard Stallman