Very Computer

I have a new install of Linux (SuSE 7.3) - on two machines - over time
there is a gradual increase in the number of cron sa2 (from SAR), and
sleep processes, seems like two form a day - over time they use
memory, and a reboot is required to keep the system stable ...

What is the source of these processes, and how would I disable them...
A partial dump of ps -ef shows.....

root      1210   778  0 Aug15 ?        00:00:00 /USR/SBIN/CRON
root      1214  1210  0 Aug15 ?        00:00:00 /bin/sh
/usr/lib/sa/sa2 -A
root     23325   778  0 00:00 ?        00:00:00 /USR/SBIN/CRON
root     23329 23325  0 00:00 ?        00:00:00 /bin/sh
/usr/lib/sa/sa2 -A
root      2200   778  0 06:00 ?        00:00:00 /USR/SBIN/CRON
root      2204  2200  0 06:00 ?        00:00:00 /bin/sh
/usr/lib/sa/sa2 -A
root      2631   778  0 12:00 ?        00:00:00 /USR/SBIN/CRON
root      2635  2631  0 12:00 ?        00:00:00 /bin/sh
/usr/lib/sa/sa2 -A
root      2736   363  0 12:00 ?        00:00:00 /usr/sbin/sshd
root      2830  2635  0 12:00 ?        00:00:00 sleep 1
root      2831  2204  0 12:00 ?        00:00:00 sleep 1
root      2832 23329  0 12:00 ?        00:00:00 sleep 1
root      2834  1214  0 12:00 ?        00:00:00 sleep 1

In 40 days this list would be 10 times this size - help

Quote:> I have a new install of Linux (SuSE 7.3) - on two machines - over time
> there is a gradual increase in the number of cron sa2 (from SAR), and
> sleep processes, seems like two form a day - over time they use
> memory, and a reboot is required to keep the system stable ...

> What is the source of these processes, and how would I disable them...

No. Logs.
Logs logs logs logs - and more logs.

/var/log/sa/*, var/log/messages, /var/log/cron

Are there errors  in any of these ?

To just disable the sar job, delete it from cron (/etc/cron.d/sysstat on
RH7.2 - I don't know where SuSE puts it.)
Alternatively, chmod a-x to clear the executable bits...

Looking at your ps output, it would seem that the sa commands cannot
complete - that's why they are sent to sleep.
Maybe your /var partition is full ? or the write permissions are wrong ?
what's the system load while this happens ?

Research, reasearch...

HTH

Excellent starts ... well df shows 37% of the disk in use, space
should not be an issue, /var/log is owned by root, as are the
subdirectories.

A dump of messages looks like this...

linuxbox:/var/log # tail -30 messages
Aug 17 05:59:00 linuxbox /USR/SBIN/CRON[25614]: (root) CMD ( rm -f
/var/spool/cron/lastrun/cron.hourly)
Aug 17 06:00:00 linuxbox /USR/SBIN/CRON[29252]: (root) CMD (
/usr/lib/sa/sa2 -A   #update reports every 6 hour)
Aug 17 06:00:00 linuxbox /USR/SBIN/CRON[29256]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 06:10:00 linuxbox /USR/SBIN/CRON[1396]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 06:20:00 linuxbox /USR/SBIN/CRON[5911]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 06:30:00 linuxbox /USR/SBIN/CRON[10461]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 06:40:00 linuxbox /USR/SBIN/CRON[15021]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 06:50:00 linuxbox /USR/SBIN/CRON[19590]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 06:59:00 linuxbox /USR/SBIN/CRON[20449]: (root) CMD ( rm -f
/var/spool/cron/lastrun/cron.hourly)
Aug 17 07:00:00 linuxbox /USR/SBIN/CRON[24145]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 07:10:00 linuxbox /USR/SBIN/CRON[28712]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 07:20:00 linuxbox /USR/SBIN/CRON[850]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 07:30:00 linuxbox /USR/SBIN/CRON[5421]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 07:40:00 linuxbox /USR/SBIN/CRON[9979]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 07:50:00 linuxbox /USR/SBIN/CRON[14546]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 07:59:01 linuxbox /USR/SBIN/CRON[15408]: (root) CMD ( rm -f
/var/spool/cron/lastrun/cron.hourly)
Aug 17 08:00:00 linuxbox /USR/SBIN/CRON[19040]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 08:10:00 linuxbox /USR/SBIN/CRON[23605]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 08:20:00 linuxbox /USR/SBIN/CRON[28179]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 08:30:00 linuxbox /USR/SBIN/CRON[32743]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 08:40:00 linuxbox /USR/SBIN/CRON[4877]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 08:50:00 linuxbox /USR/SBIN/CRON[9443]: (root) CMD (
/usr/lib/sa/sa1      )
Aug 17 08:59:00 linuxbox /USR/SBIN/CRON[10298]: (root) CMD ( rm -f
/var/spool/cron/lastrun/cron.hourly)

SO - cron is running SA often

and finaly sysstat has the following text....

#crontab for sysstat

#activity reports every 10 minutes everyday
*/10 *   * * *     root  /usr/lib/sa/sa1

#update reports every 6 hour
0    */6 * * *     root  /usr/lib/sa/sa2 -A   #update reports every 6
hour

To which I say I should kill the sysstat entries and that should take
care of it... ? agree

There is nothing in /var/log/sa that is readable

Quote:> Excellent starts ... well df shows 37% of the disk in use, space
> should not be an issue, /var/log is owned by root, as are the
> subdirectories.

This is not at all true for all log directories....(again, on my RH7.2 box)

Quote:

> A dump of messages looks like this...

<snippety snip>

Quote:> SO - cron is running SA often

Yes, it does - it takes a snapshot of running processes, system load and
memory usage.

Quote:

> and finaly sysstat has the following text....

> #crontab for sysstat

> #activity reports every 10 minutes everyday
> */10 *   * * *     root  /usr/lib/sa/sa1

> #update reports every 6 hour
> 0    */6 * * *     root  /usr/lib/sa/sa2 -A   #update reports every 6
> hour

> To which I say I should kill the sysstat entries and that should take
> care of it... ? agree

Yes, it should - but that still doesn't explain why it fails to run
properly.

Quote:

> There is nothing in /var/log/sa that is readable

No, it's a binary report meant to be interpreted by specialist log
analysers.

I never managed to figure out what to do with them, anyway ;-)

Just disable it.

Right - it is disabled -
Right again - the problem is that sar is not running correctly - given
it starts every 10 minutes and 2-3 processes occur a day that is not
too bad, but I am not going to waste my time debuging it's problem -
will remove from crontab

thanks for the input.

amk