#Howto find causes of CPU load

1 messages · Page 1 of 1 (latest)

proven shoal
#

I have a Proxmox Server running with several Container. I see in my grafical interface that i get every 5 minutes a significant CPU load.
In general it is no problem but i want to understand which task causes this CPU load.
BUT i do not know where to look at.
I tried to have a look into /var/log syslog but i couldnt find something specific to these times when it is happening.
Can anybody tell me where to look at to provide more information ?

Many thanks in advance !

image.png
indigo geyser
#

Try something like a process monitor. Something like htop.

proven shoal
# indigo geyser Try something like a process monitor. Something like `htop`.

i checked now some things and i realised that every 5 minutes a connection seems to be open. but i dont know which connection this is. Can anyone help ?

Dec 30 09:24:51 Grafana systemd[1]: Started OpenBSD Secure Shell server per-connection daemon (172.20.x.y:45696).
Dec 30 09:24:51 Grafana systemd[1]: Created slice User Slice of UID 1000.
Dec 30 09:24:51 Grafana systemd[1]: Starting User Runtime Directory /run/user/1000...
Dec 30 09:24:51 Grafana systemd[1]: Finished User Runtime Directory /run/user/1000.
Dec 30 09:24:51 Grafana systemd[1]: Starting User Manager for UID 1000...
Dec 30 09:24:51 Grafana systemd[561730]: Queued start job for default target Main User Target.
Dec 30 09:24:51 Grafana systemd[561730]: Created slice User Application Slice.
Dec 30 09:24:51 Grafana systemd[561730]: Reached target Paths.
Dec 30 09:24:51 Grafana systemd[561730]: Reached target Timers.
Dec 30 09:24:51 Grafana systemd[561730]: Listening on GnuPG network certificate management daemon.
Dec 30 09:24:51 Grafana systemd[561730]: Listening on GnuPG cryptographic agent and passphrase cache (access for web browsers).

indigo geyser
proven shoal
indigo geyser
proven shoal
indigo geyser
proven shoal
# indigo geyser Read each line by line.

yes but it says nothing to me like this here:

Type=notify
Restart=on-failure
NotifyAccess=main
RestartUSec=100ms
TimeoutStartUSec=1min 30s
TimeoutStopUSec=1min 30s
TimeoutAbortUSec=1min 30s
TimeoutStartFailureMode=terminate
TimeoutStopFailureMode=terminate
RuntimeMaxUSec=infinity
WatchdogUSec=infinity

indigo geyser
proven shoal
#

to what i have look to ?

indigo geyser
#

I have pointed out the keywords to look for.

proven shoal
#

nothing special:
After=basic.target auditd.service -.mount network.target systemd-journald.socket sysinit.target ssh.socket system.slice
RequiresMountsFor=/run/sshd
Documentation="man:sshd(8)" "man:sshd_config(5)"
Description=OpenBSD Secure Shell server
LoadState=loaded
ActiveState=inactive
FreezerState=running
SubState=dead
FragmentPath=/lib/systemd/system/ssh.service
UnitFileState=enabled
UnitFilePreset=enabled

indigo geyser
#

That's the bottom? if not, keep going.

proven shoal
#

AssertResult=no
ConditionTimestampMonotonic=0
AssertTimestampMonotonic=0
Transient=no
Perpetual=no
StartLimitIntervalUSec=10s
StartLimitBurst=5
StartLimitAction=none
FailureAction=none
SuccessAction=none
CollectMode=inactive

#

that are the last lines

#

nothing unusual what i see

indigo geyser
#

See this paste, #1057918117772279870 message

proven shoal
#

it is the bottom !

indigo geyser
#

No, I am looking at the few lines in that paste. The other pastes provides hints on what the unit does should certain conditions exist. It should not be restarting if it failed.

proven shoal
indigo geyser
# 
After=basic.target auditd.service -.mount network.target systemd-journald.socket sysinit.target ssh.socket system.slice

Describes exactly how the unit is started

FailureAction=none

Describes what action to take if failed.

proven shoal
#

Yes that is understood, but my question is WHY it is started every 5 minutes and who started it and why does this service want to connect to one of my cloudserver ?
That should be somewhere configured but i dont know where.

here is the complete log:

indigo geyser
#
  • Who started it,
Dec 30 09:24:51 Grafana systemd[1]: Started OpenBSD Secure Shell server per-connection daemon (172.20.x.y:45696).
  • Why does this service wants to start,
After=basic.target auditd.service -.mount network.target systemd-journald.socket sysinit.target ssh.socket system.slice
  • Why does this service wants to connect to one of your cloudserver
    That is not how that works, it's a daemon, means it runs on the same machine that hosts systemd. It is not connecting to anything, rather it is listening.
proven shoal
#

Okay understood. It is not needed but maybe causes these 5 minutes peaks (by the way ON ALL of my container machines !!!) --> so question can i stop this procedure / behaviour ?

indigo geyser
#

You can stop the unit, but you'll have no SSH access to that machine.

proven shoal
#

somehow crazy but it seems to be that i have to accept it even if i dont need and dont want these cpu peaks !

Maybe i can stop ssh and look via proxmox console on the container and see if the 5 minutes peak disappaers ?
Or can i extend the intervall to once a day and not 5 minutes ?

indigo geyser
#

SSHd should only be started once, and that is primarily during system boot. There should be no reason why it'd be restarting every five minutes unless the host is being starved of resources or something.

Furthermore, unless this is some embedded device that is hosting it, SSHd shouldn't be causing these sorts of CPU spikes. On most modern machines, SSHd starting is not even noticeable, in comparison to other daemons (hint: modern web daemons for instance).