[CentOS] Load Average ~0.40 when idle

[Stephen John Smoogen]

On Sun, Jul 20, 2008 at 4:52 PM, listmail <listmail at entertech.com> wrote:
> On Sat, 19 Jul 2008 21:56:45 -0700, John R Pierce wrote
>> Stephen John Smoogen wrote:
>> > On Sat, Jul 19, 2008 at 2:48 PM, listmail <listmail at entertech.com> wrote:
>> >
>> >> I am running CentOS 5 on a dual-dual-core Intel machine, and I am seeing
>> >> a load average of between 0.35 and 0.50 while the machine is idle, i.e.
>> >> no processes appear to be running.
>> >
>> > Download the livecd and boot using it. See if the load average still
>> > occurs. Check to see if you have any traffic occuring on the network
>> > from the system. [I had a box that was kernel trojaned that had a load
>> > average all the time when it was on the wire and did not when it
>> > didn't. The kernel trojan was looking for a particular bit of traffic
>> > that would open up its backdoor to.]
>> >
>>
>> its been ages since i've had to do this, but in years past, rkhunter
>> was really good at finding rootkits like this.   worst case, you put
>> it on alive CD and run it from there.
>>
> OK, I downloaded the CentOS 5.2 Live CD and booted from it. To eliminate
> load from the GUI, I forced the system into runlevel 3 and ran top.
> I see the same problem; the load average sits at about 0.40 continuously.
> This is with the ethernet drivers running, and it does not matter if the
> network cables are plugged in or not.
>

Ok sorry for the wild goose chase earlier...

1. Check with the manufacturer or motherboard to see if this is a
known issue. Sometimes these items show up and are fixed with a BIOS
update.
2. Check to see if you can pinpoint where the problem is coming
from... set up sar and iostat to see if there are excessive irq's on
one line or another. Run the system as a minimal OS when doing this...
nothing but init 1 if possible.
3. Try Fedora 9 livecd and see if it still occurs. If it doesn't then
the problem was fixed in the main kernel between EL-5 and now. That
can help make it easier to track down for a bug in Red Hat's bugzilla.


> In my mind, that pretty much eliminates the possibility of a rootkit, unless
> one was delivered with the Live CD. :-)  So it looks like this is a bug
> in either the Intel GLAN driver, or some other kernel timing issue. If anyone
> can suggest where this bug should be reported and is likely to be addressed,
> please let me know. I don't know myself who would be the correct party to
> notify.
>
> Thanks to everyone who responded and helped me track this one down. I'm not
> sure if should roll back to CentOS 5.0, or just try to live with this bug
> until the maintainers address it, but at least I have some idea of what's
> wrong.
>
> Thanks,
> --Bill
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>



-- 
Stephen J Smoogen. -- BSD/GNU/Linux
How far that little candle throws his beams! So shines a good deed
in a naughty world. = Shakespeare. "The Merchant of Venice"