Mysterious bash instances using a lot of CPU, how can I debug?
Take a look at the output of lsof | grep 'bash.*cwd'
. That will tell you the current working directories of the processes.
If you have pstree
, take a look at its output. If not, take a look at the output of ps aux -H
. That will tell you which processes own these mystery processes.
Start looking through configuration files for anything suspicious. Here's an incomplete list of ones you should check:
~/.bash*
~/.profile
/etc/profile
/etc/bash*
/etc/cron.*/*
The [process name]
means that ps
can't find that process' arguments, including argument 0 which contains the name of the file that was executed to create the process. That means lsof /bin/bash
won't find these processes.
You can also take a look at output of:
ps -p <pid> -o pid,user,tty,comm,args
Some shell scripts will appear as /bin/bash
or perl
in the output of top
but args
argument in the output of ps
should give you the exact script running.