[CentOS] Load Average ~0.40 when idle

Sat Jul 19 21:50:18 UTC 2008
listmail <listmail at entertech.com>

On Sat, 19 Jul 2008 13:58:15 -0700 (PDT), Mark Pryor wrote
> --- On Sat, 7/19/08, listmail <listmail at entertech.com> wrote:
> 
> > From: listmail <listmail at entertech.com>
> > Subject: [CentOS] Load Average ~0.40 when idle
> > To: "CentOS mailing list" <centos at centos.org>
> > Date: Saturday, July 19, 2008, 1:48 PM
> > I am running CentOS 5 on a dual-dual-core Intel machine, and
> > I am seeing
> > a load average of between 0.35 and 0.50 while the machine
> > is idle, i.e.
> > no processes appear to be running.
> > 
> > Both top and uptime report the same thing. Looking at top,
> > I cannot see 
> > any processes that are using CPU time except for top and
> > init, and they are
> > not using enough cycles to push up the load average.
> > 
> > According to top, there are occasional tiny (like 0.5%)
> > bumps in the
> > system usage occasionally, and almost no user space usage.
> > Again, not
> > enough to account for the load average I am seeing.
> > 
> > I have tried a couple of kernel updates, and upgraded from
> > CentOS 5.0 to 5.2,
> > none of which make any difference.
> > 
> > Has anyone else seen this? And can anyone recommend a way
> > to figure out
> > what is causing the load average to be this high when the
> > machine is idle?
> 
> I have not seen this with any C5. However I have moved all
> /etc/cron.daily/prelink
> /etc/cron.daily/makewhatis
> 
> to the weekly.
> 
> check /var/log/secure for dictionary attacks
> 
> check your /var/log/httpd/access_log for unusual PHP activity
> 
> check http://localhost/usage for the webalizer logs, where maybe something
>    will standout.
> 
Thanks, Mark. I have done all of that. There was a dictionary attack a few
days ago, but there is no activity now. Since this is a new machine that
I am just burning in, I am tempted to reinstall from scratch in case the
machine somehow got hacked during burn-in. I don't see any stuck processes,
or any other clues. I have an identical machine running a slightly older
version of the kernel (CentOS 5.0 - 2.6.18.53.1.14.el5) that does not
exhibit this problem, so I am a bit suspicious. Has anyone else noticed
anything like this?

Thanks,
--Bill