0

I'm chasing down some performance problems on a Linux server, and I've setup BSD process accounting to track down what might be causing the load. However, I'm seeing a lot of processes called "Filesystem", like this:

sed                    root     ??         0.00 secs Thu Oct 22 06:00
Filesystem        F    root     ??         0.00 secs Thu Oct 22 06:00
sed                    root     ??         0.00 secs Thu Oct 22 06:00
Filesystem        F    root     ??         0.00 secs Thu Oct 22 06:00
Filesystem        F    root     ??         0.00 secs Thu Oct 22 06:00
which                  root     ??         0.00 secs Thu Oct 22 06:00
which                  root     ??         0.00 secs Thu Oct 22 06:00
cut                    root     ??         0.00 secs Thu Oct 22 06:00
grep                   root     ??         0.00 secs Thu Oct 22 06:00
Filesystem        F    root     ??         0.00 secs Thu Oct 22 06:00
cut                    root     ??         0.00 secs Thu Oct 22 06:00
Filesystem             root     ??         0.01 secs Thu Oct 22 06:00
Filesystem        F    root     ??         0.00 secs Thu Oct 22 06:00
grep                   root     ??         0.00 secs Thu Oct 22 06:00
Filesystem             root     ??         0.00 secs Thu Oct 22 06:00

I don't have a program called "Filesystem" on this machine, and Google isn't telling me anything useful about what it might represent. Has anyone dug into the source code or otherwise knows why these would be popping up?

womble
  • 95,029
  • 29
  • 173
  • 228
  • What is BSD command accounting? Would you mind to give more info on that? – Istvan Oct 24 '09 at 23:35
  • 1
    I don't think I'm going out on a limb when I say that if you don't know what BSD *process* accounting is, you're not going to be able to answer this question. – womble Oct 24 '09 at 23:45
  • @womble, that may be true, but perhaps we are interested in learning about it, and seeing if would be a tool useful for us. – Zoredache Oct 25 '09 at 00:37
  • Then give the big "Ask Question" button a whirl. – womble Oct 25 '09 at 01:51
  • He might talk about this: http://www.freebsd.org/doc/en/books/handbook/security-accounting.html – Istvan Oct 26 '09 at 11:14

2 Answers2

1

I am just grasping at straws here, don't know that much about psacct, but I'm guessing it's a "dummy" process used to represent Kernel time spent reading/writing to the filesystem? What's your iowait% look like? Are you performing many disk intensive operations? What is your disk subsystem like?

Josh
  • 9,001
  • 27
  • 78
  • 124
  • My disks are huge and impressive, but psacct doesn't account for kernel tasks as far as I can tell. You did prompt me to dig further and find the answer, though, so thanks. – womble Oct 27 '09 at 13:31
1

Found it.

I was being insufficiently thorough when I determined that I didn't have a program called Filesystem on the machine -- in fact, there is a script called Filesystem in /usr/lib/ocf/resource.d/heartbeat/Filesystem that manages the mounted filesystems in the cluster manager (DRBD volumes). It turns out it's the monitor processes for those filesystems that were causing all my consternation, and there was nothing supernatural about them after all.

womble
  • 95,029
  • 29
  • 173
  • 228