My centos server has high cpu load right now. Please see the Htop output below.enter image description here

sync_supers is very suspected but I don't know how to kill it. Any suggestions?

  • 2
    The real sync_supers is a kernel thread that does almost nothing. Your system has almost certainly been compromised. – Michael Hampton Nov 12 '14 at 23:03
  • Percentages are useless if you don't provide server's specs. – Xavier Lucas Nov 12 '14 at 23:23
  • 1
    Ran into this myself, definitely a compromised system... – c4urself Nov 27 '17 at 21:41

Killing process will not get you far. I would rather recommend stop so you can inspect what is going on. By running

kill -TERM 17757

You will kill the process (notice PID column value for sync_supers may have changed since. Instead of killing immediately try doing

kill -STOP 17757

Then inspect procfs for this process ID

ls -al /proc/17757/

It will be informative to see cwd line; it says from which dir this process was started Examine also

cat /proc/17757/cmdline

To see how process was started

And also possibly interesting info in

ls -la /proc/17757/fd

Which will tell you if any files are opened by process.

If you want to interactively snoop on what process is doing, you can attach to it with system call tracer strace like this

strace -p 17757

However if process is stopped, you would not see much since it's stopped, so this may be something to consider before doing anything to the process.

This "sync_supe" overloading CPU is an Apache (user "nobody") running a bitcoins mill, hard work and use of the resources. The system might have been compromised via 1.3 Apache and Linux kernel <2.6.25

  • 1
    How do you know, any source or details for what you're saying? – Ale May 8 '17 at 13:07

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.