Upon issuing a ps ax command on a server I see the following processes that I can't identify. Googling them yields nothing useful. Does anybody know what these are or how I would track them down?

The system is a virtual machine running on VMware. I'm not sure what version as I don't control the infrastructure but I have asked if any VM snapshots or backups are taking place and they have said no.

System is Red Hat Enterprise Linux Server release 5.4 (Tikanga) Kernel is 2.6.18-164.el5

The system has been rebooted but these processes remain.

 7158 ?        S<     0:00 [WRITE_COW_THR0]
 7159 ?        S<     0:00 [ISSUE_WR_THR0]
 7160 ?        S<     0:00 [SNAP_R_THR0]
 7161 ?        S<     0:00 [WRITE_COW_THR1]
 7162 ?        S<     0:00 [ISSUE_WR_THR1]
 7163 ?        S<     0:00 [SNAP_R_THR1]
 7164 ?        S<     0:00 [WRITE_COW_THR2]
 7165 ?        S<     0:00 [ISSUE_WR_THR2]
 7166 ?        S<     0:00 [SNAP_R_THR2]
 7167 ?        S<     0:00 [WRITE_COW_THR3]
 7168 ?        S<     0:00 [ISSUE_WR_THR3]
 7169 ?        S<     0:00 [SNAP_R_THR3]
  • 1
    They look like kernel threads. – Michael Hampton Jan 6 '15 at 20:52
  • Any chance this server runs an Oracle 12c DB with Snap Clone running? – colealtdelete Jan 7 '15 at 0:16
  • It runs databases (Progress), not Oracle. I don't believe the Progress databases do any snapshotting / cloning. If they do, it would be very unusual. – thatguy Jan 7 '15 at 0:21
  • ls -l /proc/7158/exe – psusi Jan 7 '15 at 1:18
  • exe is an invalid symlink. When I list the /proc/7158 folder, I see the following: pastebin.com/DXH8BH4d – thatguy Jan 7 '15 at 1:22

These look like copy-on-write (COW) kernel threads possible related to a filesystem snapshotting solution. Do you have something like R1Soft Hot-Copy or LVM snapshots active? Any other backup software?

Please provide a pastebin of a full process listing.

  • I agree. It does look like a kernel thread performing a snapshot but the company running the VMware host insists it is not. We are not running any snapshotting within the machine itself. I have put up the pastebin but have admittedly removed the database processes as they could identify the client. We run these databases on many servers and have never seen these processes anywhere else. pastebin.com/YdpXbak6 – thatguy Jan 6 '15 at 23:23
  • Please post the output of df -h and lvdisplay. – ewwhite Jan 6 '15 at 23:28
  • Here is a pastebin of the requested commands. pastebin.com/yVYrNYGy – thatguy Jan 6 '15 at 23:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.