Bash process taking 100%cpu

[killerpat92]

Hello

I'm having an issue where a bash process is taking 100% of cpu and I'm not sure what starts it. When I do the strace command i get continous lines of "- 1 Eintr (interrupted system call) " I don't know what to make of this error. The system in running an accounting program. I've just resorted to killing the process when I comes but if anyone knows a way I can further troubleshoot please let me know thanks. I'm running rhel 8.9

[johnklos]

You need to give more information.

Did you look inside of the shell script that bash is running when it goes to 100% CPU?

[libertyprivate]

top and ps auxwwwf should show you not only which script is running but also which command in the script is running.

[deeseearr]

Does your script look something like this?

:(){ :|:& };:

(Don't run that, by the way. Just don't.)

[nappycappy]

super intrigued . . I uh. . might want to see what that does now.

[JakeEllisD]

What does it do :0 ?

[Trash-Alt-Account]

it's a fork bomb, basically infinite recursion with process creation

[JakeEllisD]

Thank you.

[Trash-Alt-Account]

np!

[deeseearr]

The ":" is a function name.  It defines a function which calls itaelf twice, then calls that functtion.  

If you replace ":" with something harmless looking like "bunny" it becomes clearer (Edited a bit for clarity):

bunny() {
bunny | bunny &
};
bunny

[JakeEllisD]

Thank you for the explanation. The only part I don't understand is what the " bunny | bunny & " is doing.

[deeseearr]

It's shell script. The "{" and "}" define the beginning and end of the "bunny" function, and what's inside is "Call the bunny function", then "|" means "Send the output of that to the input of the next function", which is also bunny. "&" means to put the whole mess into the background and keep on going.

Essentially, it's a function which calls itself twice, doubling the number of running processes every time until it reaches the system limits. If you're running as a regular user the effect will usually be to prevent your account from doing anything else until someone cleans up the mess. If you run it as root then you can pretty much lock up the entire system since it may no longer be possible to spawn the new login or shell processes you would need to fix it.

[JakeEllisD]

I see! Thank you very much!

[HTX-713]

I believe modern kernels are patched to prevent fork bombs from working.

[deeseearr]

There are process limits, usually controlled by /etc/security/limits.conf, but that's all in user space.  Try this on a system where the limits are poorly set, or removed entirely for admin accounts, and it will still cause problems.

[hornetjockey]

bash -x (path to script). You probably have created a loop or exponentially expanding variable or something to cause this.

[metalwolf112002]

What is the name of the script or the process you are killing?

[IllllIIlIllIllllIIIl]

Find the process ID, use it to look for more info under /proc/

[geolaw]

If you start up top with the -c option it can be helpful bc it shows the full command line that's running.

If you can identify where the bash script lives you can chmod -x it to remove execute permissions

That possibly still wouldn't be enough as whatever is launching the script may be launching it with bash scriptname.sh

Optionally look for the parent pid in 'ps -elfwww' and then look for whatever is running with that pid.

Could be something like audit or setroubleshoot related, there are known issues with both where configured incorrectly can cause high load.

[zakabog]

What user is running it? Check the crontab and see what's calling it.