We may have a similar problem. We're running a 4.0 kernel on Digital Unix 4.0 with Oracle. The script that is executed at logon to start the 'pro' executable is a Korn script, although the users default shell is the Bourne shell. What I see happen is the sh process that starts the Korn shell issues 'clear' commands at an amazing rate after the user abnormally terminates. I run the following code in a Korn script periodically via crontab (as 'root') to recogize when this happening and kill the offending process:
# This looks for any high CPU process that is running the bourne
# shell ('-sh'), whose parent is 'telnetd', and is spawning children that are
# running 'clear'
typeset EMAIL_LIST="CHESSAlert@otis.com"
ps -a -o pid=1 -o pcpu=2 -o user=3 -o ppid=4 -o command=5 | egrep -v QUE | egrep -v grep | egrep -v pro4bin/pro | while read LINE
do
PCT_CPU=`echo $LINE | awk '{print $2 }'`
if [ $PCT_CPU -gt 15 ]; then
OSUSER=`echo $LINE | awk '{print $3 }'`
PPID=`echo $LINE | awk '{print $4 }'`
PRGRM=`echo $LINE | awk '{print $5,$6 }'`
PID=`echo $LINE | awk '{print $1 }'`
#find the parent process id for the high usage process if it is a shell process
if [[ $PRGRM = '-sh (sh)' ]]; then
ps -ea -o pid=1 -o user=2 -o command=3 | grep $PPID | egrep -v grep | while read LINE2
do
PARENT_USER=`echo $LINE2 | awk '{print $2 }'`
COMMAND=`echo $LINE2 | awk '{print $3}'`
if [[ $COMMAND = 'telnetd' && $PARENT_USER = 'root' ]]; then
COUNT=0
CLEAR='N'
while [[ $COUNT -lt 5 ]]
do
ps -ea -o ppid=1 -o command=2 | grep $PID | egrep -v grep | while read LINE3
do
CMMND=`echo $LINE3 | awk '{print $2 }'`
if [[ $CMMND = 'clear' ]]; then
CLEAR='Y'
fi
COUNT=`expr $COUNT + 1`
done
done
if [[ $CLEAR = 'Y' ]]; then
do_command "kill -9 $PID"
typeset MESG="Process $PID, user $OSUSER was a runaway process. The process was running '${PRGRM}'
and consuming ${PCT_CPU}% of the CPU. It was spawning 'clear' commands and the parent process was ${COMMAND}. $PID has been killed."
typeset SUBJECT="Runaway process detected"
mail_someone "$EMAIL_LIST" "$MESG" "$SUBJECT"
fi
fi
done
fi
fi
doneIt took quite a bit of futzing to get to the point where I felt safe putting in the 'kill' statement, but it has never killed anything inappropriately and we've not had troubles with slow downs due to high CPU processes since we implemented it.
It will probably take some futzing on your part, too.
When I pasted the code excerpt in it was indented for readability, but looking at the preview I see it's not going to appear that way in the post. Sorry...
Bill Coulter
