From owner-freebsd-questions@FreeBSD.ORG Fri Oct 10 11:30:07 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 54743106569E for ; Fri, 10 Oct 2008 11:30:07 +0000 (UTC) (envelope-from jdc@koitsu.dyndns.org) Received: from QMTA03.emeryville.ca.mail.comcast.net (qmta03.emeryville.ca.mail.comcast.net [76.96.30.32]) by mx1.freebsd.org (Postfix) with ESMTP id 316378FC14 for ; Fri, 10 Oct 2008 11:30:06 +0000 (UTC) (envelope-from jdc@koitsu.dyndns.org) Received: from OMTA01.emeryville.ca.mail.comcast.net ([76.96.30.11]) by QMTA03.emeryville.ca.mail.comcast.net with comcast id QzJ31a00D0EPchoA3zW6RF; Fri, 10 Oct 2008 11:30:06 +0000 Received: from koitsu.dyndns.org ([69.181.141.110]) by OMTA01.emeryville.ca.mail.comcast.net with comcast id QzW51a0092P6wsM8MzW5Hz; Fri, 10 Oct 2008 11:30:06 +0000 X-Authority-Analysis: v=1.0 c=1 a=ruLxGkQunecA:10 a=pauEDJqJWUQA:10 a=QycZ5dHgAAAA:8 a=pO8Kt_PFoeWl8VsQI_QA:9 a=HamHYtN2z6K2ZXhWBkkA:7 a=wf4bEZoqA6vKFOXpLdtRPCrD1I4A:4 a=EoioJ0NPDVgA:10 a=LY0hPdMaydYA:10 Received: by icarus.home.lan (Postfix, from userid 1000) id 373B8C9419; Fri, 10 Oct 2008 04:30:05 -0700 (PDT) Date: Fri, 10 Oct 2008 04:30:05 -0700 From: Jeremy Chadwick To: Laszlo Nagy Message-ID: <20081010113005.GA31007@icarus.home.lan> References: <48EF14E1.9080808@shopzeus.com> <57200BF94E69E54880C9BB1AF714BBCB5DE18C@w2003s01.double-l.local> <48EF1C9C.3020201@shopzeus.com> <20081010091738.GA27925@icarus.home.lan> <48EF23CB.8020104@shopzeus.com> <20081010103753.GA30120@icarus.home.lan> <48EF377F.1030606@shopzeus.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <48EF377F.1030606@shopzeus.com> User-Agent: Mutt/1.5.18 (2008-05-17) Cc: Johan Hendriks , freebsd-questions@freebsd.org Subject: Re: [SOLVED] Re: 7.1 hangs, shutdown terminated X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Oct 2008 11:30:07 -0000 On Fri, Oct 10, 2008 at 01:07:43PM +0200, Laszlo Nagy wrote: > >> Firstly, I see a periodic(8) job that DOES use find -sx, which means >> your attempt to track it down was faulty, and your syntax should have >> been "find -sx /" not "find / -sx". See here: >> >> /etc/periodic/security/100.chksetuid: find -sx $MP /dev/null -type f \ >> > Thanks for clearing that out. :-) I did not remember what it was and > failed to find it. I believe the reason you saw this process still running at 8-9 in the morning was because of the slowdown induced by lack of dirhash memory. The periodic job runs every day, usually between 0130 and 0200, so the process had been sitting there processing its heart out for 6-7 hours. Since you've tuned the dirhash stuff, I'm betting this periodic job will run much more quickly. >> $MP == mountpoint, e.g. /, /var, or any other mounted filesystem. >> >> So, what you saw was the periodic check looking for setuid-root >> binaries. >> >> Secondly, the kernel does not spawn userland processes like find(1). >> >> Thirdly, dirmem and dirmem_max are *pure* kernel things. What they do >> is control the amount of memory used for directory structure caching; >> rather than continually hit the disk every time and spend all that time >> handling directory contents, the kernel can cache previously-fetched >> contents in memory > Now it stays this value constantly: > > vfs.ufs.dirhash_mem: 44306131 > > I think it is now caching everything. > > Thank you again, and sorry for the dumb questions. You asked absolutely *no* dumb questions, especially given the circumstances! Do not be ashamed, you did the right thing. :-) -- | Jeremy Chadwick jdc at parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP: 4BD6C0CB |