0

I have been seeing a git status -s showing up in top every 30 seconds and can't figure out what's calling this command. It's showing 20%–60% CPU (on a busy 24gb production Linode running Debian 8.1) so I'd like to eliminate this from happening.

Any thoughts on how to track down the source of this? I have no cronjobs that call git, nor any that run that often. 

8332 myusername  20   0  177936   5564   4940 R  17.9  0.0   0:00.54 git status -s
... 30sec later
8395 myusername  20   0  177936   5616   4992 R  21.6  0.0   0:00.65 git status -s
... 30sec later
8444 myusername  20   0  177936   5508   4880 R  23.2  0.0   0:00.70 git status -s
... etc

I'm guessing there's a way to watch for a command to be run and capture information on it to track the source. The PID changes on each call, so it's not a long-running process, and it's only there for a second or two, making it difficult to dig deeper.

Any help much is appreciated!

UPDATE: Turns out it's somehow pm2 related, see: https://github.com/Unitech/PM2/issues/924

I have a simple node app that connects to redis and socket.io and broadcasts live notifications to users.

My app is not showing any restarts in pm2 monit and I've updated all node modules and pm2 to the latest version, and I'm still seeing that git status -s showing up in top every 30 seconds.

Improve this question

1 Answer 1

Reset to default
3

You should be able to get the auditing subsystem to help here. Add a rule that triggers on execution of /bin/git (or wherever your git is)

auditctl -w /bin/git -p x -k git_was_run

-w file to watch
-p what to watch for
-k a key to log

you can then use ausearch to find relevant log entries

ausearch -k git_was_run

should produce plenty of output that is likely to help you back track.

Improve this answer
3
  • Thanks so much for a starting point to tracking this down, much appreciated. This is the output of those commands: gist.github.com/natebeaty/ed55bc9825b4cba221878ee4e415fecc ... it's running under myusername (obscured that and sitename.com in the logs). I'm not sure what to make of that output to determine the source of the command being run. It looks like it's running more than every 30 seconds from the gist above, though grepping ps output for git doesn't show anything until it shows in top.
    – Nate Beaty
    Aug 21, 2017 at 14:34
  • 1
    Well it shows the directory cwd="/var/www/sitename.com/public_html" that it is running git on and the user it is running as. Since it is a web site, have you looked to see if you have a CGI, PHP, or script, in that folder that is running git? You might try grepping that folder for git maybe?
    – Zoredache
    Aug 24, 2017 at 23:07
  • @Zoredache that was my first guess also, and exactly what I did to start with, and git did not show up grepping all PHP files. But nginx runs as www-data and not as my username, so that shouldn't be the source. The frequency of the command is strange, showing up every 30 seconds. I keep thinking it's some kind of stuck git process that keeps trying to run again and bombing, but I've never run into anything like that. It's probably time to rebuild this box entirely, but sure is a strange impetus—rogue every-30-second git status -s!
    – Nate Beaty
    Sep 5, 2017 at 15:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .