Ubuntu host with 100% utilization in top or htop.
When I inspect the running processes, I don't see a process consuming a significant amount of CPU resources.
I've tried using commands like top, htop, and ps to list the running processes, but none of them indicate any process responsible for the high CPU usage. I checked for background tasks or services, but haven't found anything unusual.
Could anyone suggest possible reasons for this behavior and how I might identify the cause of the high CPU usage in this scenario? Any insights or troubleshooting steps would be greatly appreciated. Thank you!
Distributor ID: Ubuntu Description: Ubuntu 20.04.6 LTS Release: 20.04 Codename: focal
Yesterday, I used 'unhide' to uncover hidden processes, but I couldn't terminate them using 'kill -9'. Additionally, I couldn't identify the origins of these processes. Are there any other tools I can use? I tried using 'clamscan' to scan the root directory, but it quickly led to system restart without completion.
# unhide proc
Unhide 20130526
Copyright © 2013 Yago Jesus & Patrick Gouin
License GPLv3+ : GNU GPL version 3 or later
http://www.unhide-forensics.info
NOTE : This version of unhide is for systems using Linux >= 2.6
Used options:
[*]Searching for Hidden processes through /proc stat scanning
Found HIDDEN PID: 1936
Cmdline: "/c7c564dc"
Executable: "/c7c564dc (deleted)"
Command: "c7c564dc"
$USER=root
$PWD=/
Found HIDDEN PID: 1938
Cmdline: "/c7c564dc"
Executable: "/c7c564dc (deleted)"
Command: "c7c564dc"
$USER=root
$PWD=/
# ll /proc/1936/map_files/
total 0
dr-x------ 2 root root 0 Mar 26 10:08 ./
dr-xr-xr-x 9 root root 0 Mar 25 21:15 ../
lr-------- 1 root root 64 Mar 26 10:08 400000-c2c000 -> '/c7c564dc (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fb800000-7f31fba00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fba00000-7f31fbc00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fbc00000-7f31fbe00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fbe00000-7f31fc000000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fc000000-7f31fc200000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fc200000-7f31fc400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fc400000-7f31fc600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fc600000-7f31fc800000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fc800000-7f31fca00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fca00000-7f31fcc00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fcc00000-7f31fce00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fce00000-7f31fd000000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fd000000-7f31fd200000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fd200000-7f31fd400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fd400000-7f31fd600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fd600000-7f31fd800000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fd800000-7f31fda00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fda00000-7f31fdc00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fdc00000-7f31fde00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fde00000-7f31fe000000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fe000000-7f31fe200000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fe200000-7f31fe400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fe400000-7f31fe600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fe600000-7f31fe800000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fe800000-7f31fea00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fea00000-7f31fec00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fec00000-7f31fee00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31fee00000-7f31ff000000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31ff000000-7f31ff200000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31ff200000-7f31ff400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31ff400000-7f31ff600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31ff600000-7f31ff800000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31ff800000-7f31ffa00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31ffa00000-7f31ffc00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31ffc00000-7f31ffe00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f31ffe00000-7f3200000000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3224200000-7f3224400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3224400000-7f3224600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3224600000-7f3224800000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3224800000-7f3224a00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3224a00000-7f3224c00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3224c00000-7f3224e00000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3224e00000-7f3225000000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3225000000-7f3225200000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3225200000-7f3225400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3225400000-7f3225600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3244200000-7f3244400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3244400000-7f3244600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3274200000-7f3274400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3274400000-7f3274600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3294200000-7f3294400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3294400000-7f3294600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f32ac200000-7f32ac400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f32ac400000-7f32ac600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f32c4200000-7f32c4400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f32c4400000-7f32c4600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3304200000-7f3304400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3304400000-7f3304600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3314200000-7f3314400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3314400000-7f3314600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f331c200000-7f331c400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f331c400000-7f331c600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3324200000-7f3324400000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3324400000-7f3324600000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3326000000-7f3336000000 -> '/anon_hugepage (deleted)'
lrw------- 1 root root 64 Mar 26 10:08 7f3336000000-7f33b8000000 -> '/anon_hugepage (deleted)'
lr-------- 1 root root 64 Mar 26 10:08 7f33cc31c000-7f33cc320000 -> /usr/lib/x86_64-linux-gnu/libresolv-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc320000-7f33cc330000 -> /usr/lib/x86_64-linux-gnu/libresolv-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc330000-7f33cc334000 -> /usr/lib/x86_64-linux-gnu/libresolv-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc334000-7f33cc335000 -> /usr/lib/x86_64-linux-gnu/libresolv-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc335000-7f33cc336000 -> /usr/lib/x86_64-linux-gnu/libresolv-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc338000-7f33cc339000 -> /usr/lib/x86_64-linux-gnu/libnss_dns-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc339000-7f33cc33d000 -> /usr/lib/x86_64-linux-gnu/libnss_dns-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc33d000-7f33cc33e000 -> /usr/lib/x86_64-linux-gnu/libnss_dns-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc33e000-7f33cc33f000 -> /usr/lib/x86_64-linux-gnu/libnss_dns-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc33f000-7f33cc340000 -> /usr/lib/x86_64-linux-gnu/libnss_dns-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc340000-7f33cc343000 -> /usr/lib/x86_64-linux-gnu/libnss_files-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc343000-7f33cc34a000 -> /usr/lib/x86_64-linux-gnu/libnss_files-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc34a000-7f33cc34c000 -> /usr/lib/x86_64-linux-gnu/libnss_files-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc34c000-7f33cc34d000 -> /usr/lib/x86_64-linux-gnu/libnss_files-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cc34d000-7f33cc34e000 -> /usr/lib/x86_64-linux-gnu/libnss_files-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceb7b000-7f33ceb9d000 -> /usr/lib/x86_64-linux-gnu/libc-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33ceb9d000-7f33ced15000 -> /usr/lib/x86_64-linux-gnu/libc-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33ced15000-7f33ced63000 -> /usr/lib/x86_64-linux-gnu/libc-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33ced63000-7f33ced67000 -> /usr/lib/x86_64-linux-gnu/libc-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33ced67000-7f33ced69000 -> /usr/lib/x86_64-linux-gnu/libc-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33ced6d000-7f33ced7a000 -> /usr/lib/x86_64-linux-gnu/libm-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ced7a000-7f33cee21000 -> /usr/lib/x86_64-linux-gnu/libm-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33cee21000-7f33ceeba000 -> /usr/lib/x86_64-linux-gnu/libm-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceeba000-7f33ceebb000 -> /usr/lib/x86_64-linux-gnu/libm-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceebb000-7f33ceebc000 -> /usr/lib/x86_64-linux-gnu/libm-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceebc000-7f33ceebd000 -> /usr/lib/x86_64-linux-gnu/libdl-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceebd000-7f33ceebf000 -> /usr/lib/x86_64-linux-gnu/libdl-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceebf000-7f33ceec0000 -> /usr/lib/x86_64-linux-gnu/libdl-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceec0000-7f33ceec1000 -> /usr/lib/x86_64-linux-gnu/libdl-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceec1000-7f33ceec2000 -> /usr/lib/x86_64-linux-gnu/libdl-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceec2000-7f33ceec4000 -> /usr/lib/x86_64-linux-gnu/librt-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceec4000-7f33ceec8000 -> /usr/lib/x86_64-linux-gnu/librt-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceec8000-7f33ceeca000 -> /usr/lib/x86_64-linux-gnu/librt-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceeca000-7f33ceecb000 -> /usr/lib/x86_64-linux-gnu/librt-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceecb000-7f33ceecc000 -> /usr/lib/x86_64-linux-gnu/librt-2.31.so
lr-------- 1 root root 64 Mar 26 10:08 7f33ceecc000-7f33ceed2000 -> /usr/lib/x86_64-linux-gnu/libpthread-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33ceed2000-7f33ceee3000 -> /usr/lib/x86_64-linux-gnu/libpthread-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33ceee3000-7f33ceee9000 -> /usr/lib/x86_64-linux-gnu/libpthread-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33ceee9000-7f33ceeea000 -> /usr/lib/x86_64-linux-gnu/libpthread-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33ceeea000-7f33ceeeb000 -> /usr/lib/x86_64-linux-gnu/libpthread-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33ceef9000-7f33ceefa000 -> /usr/lib/x86_64-linux-gnu/ld-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33ceefa000-7f33cef1d000 -> /usr/lib/x86_64-linux-gnu/ld-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33cef1d000-7f33cef25000 -> /usr/lib/x86_64-linux-gnu/ld-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33cef26000-7f33cef27000 -> /usr/lib/x86_64-linux-gnu/ld-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 7f33cef27000-7f33cef28000 -> /usr/lib/x86_64-linux-gnu/ld-2.31.so*
lr-------- 1 root root 64 Mar 26 10:08 e2b000-e5f000 -> '/c7c564dc (deleted)'
lr-------- 1 root root 64 Mar 26 10:08 e5f000-e6d000 -> '/c7c564dc (deleted)'
# ll /proc/1936/fd
total 0
dr-x------ 2 root root 0 Mar 26 10:08 ./
dr-xr-xr-x 9 root root 0 Mar 25 21:15 ../
lr-x------ 1 root root 64 Mar 26 10:10 0 -> /dev/null
l-wx------ 1 root root 64 Mar 26 10:10 1 -> /dev/null
lrwx------ 1 root root 64 Mar 26 10:10 10 -> 'anon_inode:[eventfd]'
lrwx------ 1 root root 64 Mar 26 10:10 11 -> 'anon_inode:[eventfd]'
lrwx------ 1 root root 64 Mar 26 10:10 12 -> 'anon_inode:[eventfd]'
lr-x------ 1 root root 64 Mar 26 10:10 13 -> /dev/null
lrwx------ 1 root root 64 Mar 26 10:10 14 -> 'socket:[531426]'
lrwx------ 1 root root 64 Mar 26 10:10 16 -> 'socket:[530634]'
lrwx------ 1 root root 64 Mar 26 10:10 17 -> 'socket:[531425]'
l-wx------ 1 root root 64 Mar 26 10:10 2 -> /dev/null
lr-x------ 1 root root 64 Mar 26 10:10 3 -> 'pipe:[32178]'
lr-x------ 1 root root 64 Mar 26 10:10 4 -> /dev/urandom
lrwx------ 1 root root 64 Mar 26 10:10 5 -> 'anon_inode:[eventpoll]'
lr-x------ 1 root root 64 Mar 26 10:10 6 -> 'pipe:[170]'
l-wx------ 1 root root 64 Mar 26 10:10 7 -> 'pipe:[170]'
lr-x------ 1 root root 64 Mar 26 10:10 8 -> 'pipe:[43169]'
l-wx------ 1 root root 64 Mar 26 10:10 9 -> 'pipe:[43169]'
