[LA.pm] perl cpu spike

[Benjamin J. Tilly]

"David Crean" <david at manicelement.com> wrote:
> 
> We have a webserver running mandrake linux.  It's a pretty basic 
> server that gets respectable, but not mind-bending traffic.  We use 
> coldfusion development environment, and mssql server (housed on a 
> different machine in the same location).  This computer also runs 
> some small time email and handles some dns.  Two nights ago we had 
> an issue, and while looking into it we found that perl was running 
> at 99% CPU for a good long time.  We don't really have anything 
> that runs on perl, or uses perl.  The DNS and webmin use it to some 
> small degree, but nothing that could account for this kind of 
> spike.  Anyone experienced this before?

I'll give you 3 possibilities.

1. Some piece of Perl was poorly written and got into a tight
   loop somewhere.
2. There's a Perl job there that you don't know about.
3. Someone who isn't supposed to have access got access.

The third is unlikely (rootkits generally run fairly fast).
None of us have information on the first two.

If it happens again then identify the process ID, and poke
around in /proc/<pid>/ to see if you can learn something
more about the offending process.

Cheers,
Ben