On Sat, 19 Jul 2008 13:58:15 -0700 (PDT), Mark Pryor wrote > --- On Sat, 7/19/08, listmail <listmail at entertech.com> wrote: > > > From: listmail <listmail at entertech.com> > > Subject: [CentOS] Load Average ~0.40 when idle > > To: "CentOS mailing list" <centos at centos.org> > > Date: Saturday, July 19, 2008, 1:48 PM > > I am running CentOS 5 on a dual-dual-core Intel machine, and > > I am seeing > > a load average of between 0.35 and 0.50 while the machine > > is idle, i.e. > > no processes appear to be running. > > > > Both top and uptime report the same thing. Looking at top, > > I cannot see > > any processes that are using CPU time except for top and > > init, and they are > > not using enough cycles to push up the load average. > > > > According to top, there are occasional tiny (like 0.5%) > > bumps in the > > system usage occasionally, and almost no user space usage. > > Again, not > > enough to account for the load average I am seeing. > > > > I have tried a couple of kernel updates, and upgraded from > > CentOS 5.0 to 5.2, > > none of which make any difference. > > > > Has anyone else seen this? And can anyone recommend a way > > to figure out > > what is causing the load average to be this high when the > > machine is idle? > > I have not seen this with any C5. However I have moved all > /etc/cron.daily/prelink > /etc/cron.daily/makewhatis > > to the weekly. > > check /var/log/secure for dictionary attacks > > check your /var/log/httpd/access_log for unusual PHP activity > > check http://localhost/usage for the webalizer logs, where maybe something > will standout. > Thanks, Mark. I have done all of that. There was a dictionary attack a few days ago, but there is no activity now. Since this is a new machine that I am just burning in, I am tempted to reinstall from scratch in case the machine somehow got hacked during burn-in. I don't see any stuck processes, or any other clues. I have an identical machine running a slightly older version of the kernel (CentOS 5.0 - 2.6.18.53.1.14.el5) that does not exhibit this problem, so I am a bit suspicious. Has anyone else noticed anything like this? Thanks, --Bill