Who is stealing my pids?

Question

I noticed that my Debian Jessie system is using many pids, even when the system is (should be) largely idle. The following shows that more or less 270 pids are used per 10s, while the number of active processes stays more or less the same:

$ while :; do echo -n "$(ps | tail -n 1 | cut -d' ' -f1) "; ps aux | wc -l; sleep 10; done
15008 155
15280 155
15555 155
15800 155
16074 155
16343 155
16612 155
16881 155
17150 155
17418 155
17688 155

Even though system load isn't very high, I'd like to investigate this and fix it (if possible) before it becomes a problem.

score 2 · Accepted Answer · answered Apr 05 '16 at 08:47

If the load stay low and the process count stay pretty constant, that just means short lived processes are spawn during the ten second period. Twenty seven processes per second might not be a problem at all so there might be nothing to fix.

On the other hand, that might be a bogus daemon or something trying to launch a process that quickly fails and doing it again in an endless loop.

To find it out, I would recommend using one of the utilities also created by Solaris dtrace execsnoop author, for example that one using ftrace or that other one using systemtap.

score 0 · Answer 2 · edited May 23 '17 at 12:40

0

If nothing else, your shell script creates a process for each command such as ps, cut, tail, etc., in that loop. You could only observe the systems with an application (one process...) which scanned the /proc filesystem looking for relevant changes.

Further reading:

edited May 23 '17 at 12:40

Community

1

answered Apr 05 '16 at 08:14

Thomas Dickey

75,040
9
171
268

Well, yes, that shell script uses some resources as well -- but no 270 pids in every iteration, right? Do you have a specific program in mind to monitor `/proc`? – Apr 05 '16 at 08:15
I think you'd have to write one. `top` is a good place to start. – Thomas Dickey Apr 05 '16 at 08:16
Top would likely miss most processes lasting a few milliseconds or even less. – jlliagre Apr 05 '16 at 15:47
I had in mind a developer as audience. Sorry for wasting your time. – Thomas Dickey Apr 05 '16 at 20:52
No problem, you didn't waste my or anyone's time. Sorry if my comment suggested otherwise. – jlliagre Apr 05 '16 at 23:26

Who is stealing my pids?

2 Answers2