(Source: joxi.ru )
(Source: joxi.ru )
Sometimes we have high processor loads with some system tasks.
Not processes from Userland, but the “system” loads.
Those. Some system calls are clearly performed (memory allocation, context switching), or drivers (process interrupts or something else), goes active input.
It’s all I always assume
but how to find out exactly why high loading – I can not imagine. Therefore, I ask for help.
Now I use some indirect methods, but they are not always suitable: to look in IoTOP, to resort the processes one by one, and whether the load did not sleep.
But sometimes you just can not stop the services. And sometimes the processes of working already almost left, and the load is still there.
I want to find some means quickly and accurately recognize what the processor is loaded.
Answer 1, Authority 100%
you
-
You need to go to here , you can find the Russian translation or similar articles. Will help you limit selectively CPU consumption processes
-
Read about Strace and similar to it
Sudo Strace -T -E TRACE = Open, Connect, Accept Unity
You can see a lot of interesting -
for kernel – ftrace or look for more kernel tracer-rs
Utilities that gives to understand this from one glance I don’t know if you do not come together, I would go to the following way: to configure the monitoring of the processes so that in the event of a load on K% on N seconds by any process, he gave Alert.
You can scripting so that when an alert occurs, the monitoring of TRACE has been monitored for this process, for a second, permiss, and maintain a list of the most commonly performed / long functions.
But here you need to be careful not to sow the system and do not fill the HDD. Those. Scripting must take into account that it is not necessary to put TRACE to the process that has already been under the trace (i.e., for which TRACEFILE is already saved), otherwise the processes will begin to slow down even more, for example. You can not trave too long – you don’t need gigabyte dumps.
If you solve a specific task of dealing with DDOS – well, or a lot of money and a lot of DC (lucky, if you have), or CloudFlare – I would like it to start.
i.e. Everything depends on the tasks, the kernel driver is to exhibit – one approach, defend against DDOS – the other.
Answer 2, Authority 33%
Red strip talks about IO-Wait or interrupts. This is the work of drivers and kernel.
Open the usual TOP. There will be a line:
% CPU (S): 15.3 US, 1.4 SY, 0,0 Ni, 78,8 ID, 3.4 WA, 0.8 Hi, 0.3 Si, 0.0 ST
If a large number in front of WA – the output device is slower than the scheduler. Most often it is Record to a dead hard drive , but also can manifest when working as a video card (mining on the GPU). Record on a network drive.
hi and si is interrupts. Often met with a burnt network map.
Look later we look at the process in the top. There or in square brackets specified the driver or without them. Something like KWORKER / U8: 7 + EVENTS_UNBOUND, LOOP8 and so on. The name indicates what it is both the instance number. Combating in / proc /, / sys / you can compare the process with the device.
It is worth paying attention to the usual services that may want from the kernel too much. For example, accelerate encryption on a trimmed processor. But there are usually strips half green, half red.
More tricks can be on virtuals when another virtuka eats resources.