[SOLVED] Re: 7.1 hangs, shutdown terminated

[Jeremy Chadwick]

On Fri, Oct 10, 2008 at 01:07:43PM +0200, Laszlo Nagy wrote:
>
>> Firstly, I see a periodic(8) job that DOES use find -sx, which means
>> your attempt to track it down was faulty, and your syntax should have
>> been "find -sx /" not "find / -sx".  See here:
>>
>> /etc/periodic/security/100.chksetuid:   find -sx $MP /dev/null -type f \
>>   
> Thanks for clearing that out. :-) I did not remember what it was and  
> failed to find it.

I believe the reason you saw this process still running at 8-9 in the
morning was because of the slowdown induced by lack of dirhash memory.
The periodic job runs every day, usually between 0130 and 0200, so
the process had been sitting there processing its heart out for 6-7
hours.

Since you've tuned the dirhash stuff, I'm betting this periodic job will
run much more quickly.

>> $MP == mountpoint, e.g. /, /var, or any other mounted filesystem.
>>
>> So, what you saw was the periodic check looking for setuid-root
>> binaries.
>>
>> Secondly, the kernel does not spawn userland processes like find(1).
>>
>> Thirdly, dirmem and dirmem_max are *pure* kernel things.  What they do
>> is control the amount of memory used for directory structure caching;
>> rather than continually hit the disk every time and spend all that time
>> handling directory contents, the kernel can cache previously-fetched
>> contents in memory
> Now it stays this value constantly:
>
> vfs.ufs.dirhash_mem: 44306131
>
> I think it is now caching everything.
>
> Thank you again, and sorry for the dumb questions.

You asked absolutely *no* dumb questions, especially given the
circumstances!  Do not be ashamed, you did the right thing.  :-)

-- 
| Jeremy Chadwick                                jdc at parodius.com |
| Parodius Networking                       http://www.parodius.com/ |
| UNIX Systems Administrator                  Mountain View, CA, USA |
| Making life hard for others since 1977.              PGP: 4BD6C0CB |