Differences

This shows you the differences between two versions of the page.

--- process_investigation [2016/01/28 09:25] – luke7858
+++ process_investigation [2024/05/23 07:26] (current) – external edit 127.0.0.1
@@ Line 1: / Line 1: @@
 === processes investigation ===
+Please see [[top5_cpu_processes|top CPU consumers]] or [[ram_diagnostics|top RAM consumers]] for commands to find the offending processes
+\\
+Example Process:
+<sxh bash>
+USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
+apache   1234  99.0  40.6 4704844 400260 ?      S    11:08   0:08 /usr/sbin/httpd
+</sxh>
+\\
+=== Investigating a PID ===
+First we need to find out if the process is an Established connection (replace 1234 with the PID):
+<sxh bash>
+netstat -pant | grep 1234
+</sxh>
+\\
+=== Process 'State' Investigation ===
+An important column to look into is the 'State' column. This tells you what the process is currently doing:
+\\
 ^ State ^ Definition ^
 | D  | uninterruptible sleep (usually IO) |
@@ Line 25: / Line 41: @@
 The command below runs strace for 3 seconds and then terminates the command. Replace 1234 with the PID number you are investigating:
 <sxh bash>
-timeout 3 strace -p 1234
+timeout 5 strace -p 1234
 </sxh>
+If there is some for out output on the screen, this means the process is active.
-<sxh bash>
+\\
+If there is nothing on the screen except something similar to the following then the process is not currently active:
-</sxh>
 <sxh bash>
+Process 1 attached
+<detached ...>
 </sxh>
+If the process is not active and the output from the netstat command does not return anything then the process could be dead.