'ps' behavoir in Linux - Was - Re: array limits

[Bill Vermillion]

On Sat, Apr 17, 2004 at 08:38:49AM -0500, Jerry Rains thus spoke:

> On Saturday 17 April 2004 08:58, Fairlight wrote:
>
> > Only Bill Vermillion would say something like:

> > > I just had a thought last night. Jerry said he had to be
> > > root to see things in the proc directory, and part of that
> > > is for security reasons, and different OSes may handle that
> > > differently. Newer versions of many have tightened things
> > > up as the world has become more security conscious.

> > It is true that linux's /proc will not let you see some of
> > the contents of /proc if you're not root. Moreover, you
> > can cat cmdline as a regular user, but not environ. You
> > cannot access the fd directory. There are indeed security
> > implications.

> > > And as I recall, at least in some you are not going to see the
> > > arguments if you aren't the owner of the process. Or am I
> > > remembering that incorrectly.

[a buncha stuff deleted - wjv]

Mark said:

> > I don't honestly recall ever seeing dclerk swapped and sleeping like that
> > on -any- platform.  Very strange.

> Ok, the main problem I seem to have is with the desktop Linux I
> am using. This morning I rebooted the system to shut down any
> extra processes and logged into tty1 and tty2 to start a dclerk
> process then see what was going on. I did a 'free' command and
> there was no swap memory being used, however with only the two
> text logins dclerk was still swapped out on my system. The
> logon header confirmed that my system is indeed SuSE 8.2. Since
> I only use this system for my Desktop needs, I'm not going to
> worry about why.

> My problem is at work so I dialed back in this morning. The
> system was idle and ps aux worked fine.

> SuSE Linux on iSeries -- the spicy solution!
> Have a lot of fun...
> filepro at as400linux1:/var/appl/filepro> w
>   9:13am  up  3:22,  3 users,  load average: 0.07, 0.03, 0.05
>   USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU  WHAT
>   root     pts/2    -                 8:50am 23:33   0.00s   ?     -
>   filepro  pts/3    -                 9:13am  0.00s  0.64s  0.02s  w
>   filepro at as400linux1:/var/appl/filepro> free
>                           total       used       free     shared    buffers   
> cached
> Mem:       1001668     261940     739728          0      51004     127036
>                -/+ buffers/cache:      83900     917768
>                Swap:       996020          0     996020
>                filepro at as400linux1:/var/appl/filepro> ps aux | grep dclerk
>                filepro  14020  7.0  0.1  2480 1204 pts/0    S    09:14   0:01 
> /appl/fp/dclerk vregstr -s1 -h Vregister -d
>                filepro  14038  0.0  0.0  1740  656 pts/3    S    09:14   0:00 
> grep dclerk
>                filepro at as400linux1:/var/appl/filepro>

> So the answer is, even though we have 1Gb of memory, we don't
> have enough memory to prevent swapping during operations. I'll
> look into seeing if I can move some of the memory from the
> OS400 side to the Linux partition.

If you are talking about the "S" in the display on your grep for
dclerck that means it is SLEEPING. 

If you run a full ps, or top, or anyting else that shows all
processes you will find of all the processes in the system,
only one or two will be shown as running and all others will be
sleeping. That's the way multi-tasking operating systems work.

Anyting swapped out shows a W in the BSD world.  W is documents in
the Linux man page for PS as being a BSD'ism and while a grep for
swap in the BSD man will give indicate that the W is "The process
is swapped out", you will a grep for swap will says that command
line arguments are not given for swapped out programs.

The Linux man page refering to the W in BSD is shown by "has no
resident pages".  That's just an obfuscated way of saying it is
swapped out. :-(

If you really think you are running into swap, and if you have 1GB
of RAM that shouldn't happen, run 'top' and see what the output of
that says.  M will sort by memory useage.  If you are running into
swap you may have something else with a bad memory leak.

-- 
Bill Vermillion - bv @ wjv . com