'netstat' is invading my processors

[yellow]

Quote: Originally Posted by chaim I only got one email notification on new posts and now I see a hole bunch. (yes I have instant email notification checked.)

As the email says: "There may be other replies also, but you will not receive any more notifications until you visit the forum again."

[yellow]

So when you look at the process, it's parent process is configd?

[JonMntjy]

Sort of - it's just like the original poster noted:

netstat(9529)->sh(9528)->sh(9527)->configd(86)->mach_init(2)->init(1)

So a shell script starts netstat, another script starts the script, configd starts the script..

[yellow]

Quote: Originally Posted by JonMntjy Sort of - it's just like the original poster noted: netstat(9529)->sh(9528)->sh(9527)->configd(86)->mach_init(2)->init(1) So a shell script starts netstat, another script starts the script, configd starts the script..

This is a different problem (with similar symptoms), you should probably start a new thread.

[jiclark]

yellow,

I don't know how you can be so sure that this is a "different problem". It's an almost identical parental path to my problem, so please don't go and separate this out. It's obviously a low-level problem, and all Jon's example shows is that it's not necessarily related to something that's easily traceable...

I'm no expert, by far, but please give proof of the difference before mucking up the waters here.

Thanks, John-o

[yellow]

jiclark,

Please don't get so uppity. When I read the original post and then the subsequent posts that chime in 'me too!', they strike me as similar, but not necessarily the same. It's been a while since I read this entire thread, so I'd forgotten that you tacked your problem on too. Either way, suggesting starting a new post is harmless, there's no need to flame me.

Jon is using your post earlier.. I find it HIGHLY unlikely that he has EXACTLY the same process IDs that you had. So it would be nice if he could identify and verify the parent processes as well. It would be helpful to try and determine the identity of the scripts that are being run by configd. You also have to determine if this is a problem solely with your user or with the machine. You have a mind-boggling array of login items.. have you tried disabling them all to see if the problem persists? Have you tried disabling teleportd as you noted was a possible culprit?

[JonMntjy]

I, of course, didn't get the same process ID's. I did get the same process names. I saw no relevance in providing my process ID's, and simply pasted those from the previous poster...

If the problem crops up again, (I can't duplicate at will), how can I identify the scripts? Knowing this can help me track it down.

[JonMntjy]

Good news guys - it happened again. This time I had the sense to do a ps -uax.

What I found was this:
root 5940 0.0 -0.0 18644 576 ?? S 10:35PM 0:00.00 sh /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/set-hostname
root 5942 0.0 -0.0 18644 348 ?? S 10:35PM 0:00.01 sh /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/set-hostname
root 5943 95.8 -0.0 18180 340 ?? R 10:35PM 0:25.55 netstat -rn

So it looks like the shell script calling netstat is set-hostname.

I now, unfortunately, have to leave. (I killed the process) - I'll try and investigate more tomorrow. No idea what Kicker.bundle is though..

I also notice that if I run netstat -rn from a shell I get
netstat: kvm_read: Bad address (repeated 87328 times)
Segmentation fault

It is unclear why either option should cause such behaviour.

[yellow]

Quote: Originally Posted by JonMntjy I, of course, didn't get the same process ID's. I did get the same process names. I saw no relevance in providing my process ID's, and simply pasted those from the previous poster....

You were right, the PIDs don't make a difference. Good catch on the scripts being run. So when you connect via modem it's trying to reset the hostname from localhost (maybe?) to whatever is provided via the ISP connection, and then back to localhost? Strange that it should choke so badly. Even stranger that you get a segmentation fault when tryling to list routing tables.

[jiclark]

Quote: Please don't get so uppity.

Jeez, look who's talking about uppity! I was just making a plea to not break up the thread under the unproven premise of it being a "different" problem; I apologize if you took it as being uppity. In rereading my post, I see no evidence of flaming at all, just a question of why starting a new thread would help. If you can give me a good reason, I'm all for it. How does pleading for an explanation of your reasoning qualify as a flame?

I was very upfront about admitting that I don't know as much as the experts here, but the fact that his process names and the exact path are the same does imply a connection, does it not?? At the very least, I don't see how you can argue that the problem is different simply bacause we don't have similar sets of login items. If I'm mistaken, please enlighten me.

BTW, I have disabled teleportd (as well as Huevos, pearCalc and The Unread; replaced by Launchbar), and although the problem happens less frequently, it has not gone away. It maybe happens once or twice a week now. And no, I have not tried disabling all of my other login items to see if the problem persists, because the problem is not frequent enough to warrant that. Besides, most of the things in my startup items list are used by millions of us everyday. There are only a handful that might not be too common, but are far from unusual.

Respectfully, John

[hayne]

Quote: Originally Posted by JonMntjy I also notice that if I run netstat -rn from a shell I get netstat: kvm_read: Bad address (repeated 87328 times) Segmentation fault

Is this a reproducible problem? (does it always do that?)
If so, I would concentrate on figuring out why your netstat is screwing up that badly. It works fine here on my 10.3.4 machine.

Try running it using the full path:
/usr/sbin/netstat -rn

Please show us what you get from:
ls -l /usr/sbin/netstat

I get:
-r-sr-xr-x 1 root wheel 90216 26 May 22:29 /usr/sbin/netstat

[yellow]

Has anyone edited /etc/hostconfig directly?

[JonMntjy]

Right, just found some more time.

To answer the questions:
'which netstat' yields /usr/sbin/netstat so I am running the right one
ls -l /usr/sbin/netstat yields
-r-sr-xr-x 1 root wheel 90216 27 May 14:08 /usr/sbin/netstat
so I think that's fine.

Right now, if I run netstat -rn, it works fine....

Which I guess makes sense. The problem is not reproducible at will - and since I've rebooted recently I hope not to see it for a day or two. When it does happen, then running netstat causes a segmentation fault, which I guess causes all the other problems. When it doesn't happen, netstat is fine (by definition). So I guess I need to find out why netstat is dying.

My /etc/hosts file is non-standard, in that it lists a number of ad-server domain names, mapping them to 127.0.0.1. I don't expect this to be a problem (I believe I did this well before this problem started). I starts like this though, which I think is standard:

127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost

My /etc/hostconfig - well I seem to have a hostconfig.old as well.....hmmm..the old has webserver set to NO and crashreporter line absent. Again, I think these are modified by system panel? Here is my entire hostconfig - does this look ok to you guys?

##
# /etc/hostconfig
##
# This file is maintained by the system control panels
##

# Network configuration
HOSTNAME=-AUTOMATIC-
ROUTER=-AUTOMATIC-

# Services
AFPSERVER=-NO-
AUTHSERVER=-NO-
AUTOMOUNT=-YES-
CUPS=-YES-
IPFORWARDING=-NO-
IPV6=-YES-
MAILSERVER=-AUTOMATIC-
NETINFOSERVER=-AUTOMATIC-
NFSLOCKS=-AUTOMATIC-
NISDOMAIN=-NO-
RPCSERVER=-AUTOMATIC-
TIMESYNC=-NO-
QTSSERVER=-NO-
WEBSERVER=-YES-
SMBSERVER=-NO-
DNSSERVER=-NO-
COREDUMPS=-NO-
VPNSERVER=-NO-
CRASHREPORTER=-YES-

[hayne]

Quote: Originally Posted by JonMntjy I guess I need to find out why netstat is dying

There might be a clue in the console log or netstat crash log (run the "Console" app to see these).

Your /etc/hostconfig seems fine.

[JonMntjy]

Good idea hayne.

Here is the bit from yesterday. It doesn't make anything clearer for me - perhaps you can interpret it! (Note this trace contains evidence of me killing netstat twice (at different times) I think).

Jun 3 21:04:28 Gabrielle pppd[5831]: pppd 2.4.2b1 started by root, uid 0
Jun 3 21:04:30 Gabrielle kernel: InternalUSBModem::setPowerState(1)
Jun 3 21:04:30 Gabrielle kernel: InternalModemSupport::acquirePort -- SUCCESS -- InternalUSBModem.kext loaded after 0000001.645 seconds
Jun 3 21:04:32 Gabrielle /usr/libexec/CCLEngine: Version 2.0
Jun 3 21:04:33 Gabrielle /usr/libexec/CCLEngine: Dialing 1470 0808 9909030
Jun 3 21:04:57 Gabrielle /usr/libexec/CCLEngine: Modem Reliable Link Established.
Jun 3 21:04:57 Gabrielle /usr/libexec/CCLEngine: Modem Compression Established.
Jun 3 21:05:00 Gabrielle pppd[5831]: Serial connection established.
Jun 3 21:05:00 Gabrielle pppd[5831]: Using interface ppp0
Jun 3 21:05:00 Gabrielle pppd[5831]: Connect: ppp0 <--> /dev/cu.modem
Jun 3 21:05:06 Gabrielle pppd[5831]: Remote message: CHAP authentication success, unit 5379
Jun 3 21:05:07 Gabrielle pppd[5831]: local IP address 81.103.218.11
Jun 3 21:05:07 Gabrielle pppd[5831]: remote IP address 81.103.219.254
Jun 3 21:05:07 Gabrielle pppd[5831]: primary DNS address 194.168.4.100
Jun 3 21:05:07 Gabrielle pppd[5831]: secondary DNS address 194.168.8.100
Jun 3 21:05:07 Gabrielle configd[103]: posting notification com.apple.system.config.network_change
Jun 3 21:05:07 Gabrielle configd[103]: executing /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/set-hostname
Jun 3 21:05:07 Gabrielle mach_init[2]: Server 0 in bootstrap d03 uid 0: "/usr/sbin/lookupd": exited as a result of signal 1 [pid 5809]
Jun 3 21:05:07 Gabrielle lookupd[5844]: lookupd (version 324.2.1) starting - Thu Jun 3 21:05:07 2004
Jun 3 21:05:07 Gabrielle named[363]: loading configuration from '/etc/com.apple.named.conf.proxy'
Jun 3 21:05:07 Gabrielle named[363]: none:0: open: /private/etc/rndc.key: file not found
Jun 3 21:05:07 Gabrielle named[363]: /etc/com.apple.named.conf.proxy:7: couldn't install keys for command channel 127.0.0.1#54: file not found
Jun 3 21:05:07 Gabrielle named[363]: /etc/com.apple.named.conf.proxy:7: couldn't add command channel 127.0.0.1#54: file not found
Jun 3 21:05:08 Gabrielle crashdump: Unable to determine CPSProcessSerNum pid: 5846 name: netstat
Jun 3 21:05:08 Gabrielle crashdump: Started writing crash report to: /Library/Logs/CrashReporter/netstat.crash.log
Jun 3 21:05:08 Gabrielle set-hostname[5852]: setting hostname to Gabrielle.local
Jun 3 21:05:12 Gabrielle crashdump: Finished writing crash report to: /Library/Logs/CrashReporter/netstat.crash.log
Jun 3 22:34:41 Gabrielle pppd[5831]: Terminating on signal 15.
Jun 3 22:34:41 Gabrielle configd[103]: posting notification com.apple.system.config.network_change
Jun 3 22:34:41 Gabrielle named[363]: loading configuration from '/etc/com.apple.named.conf.proxy'
Jun 3 22:34:41 Gabrielle configd[103]: executing /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/set-hostname
Jun 3 22:34:41 Gabrielle mach_init[2]: Server 0 in bootstrap d03 uid 0: "/usr/sbin/lookupd": exited as a result of signal 1 [pid 5844]
Jun 3 22:34:41 Gabrielle named[363]: /etc/com.apple.named.conf.proxy:26: no forwarders seen; disabling forwarding
Jun 3 22:34:41 Gabrielle named[363]: none:0: open: /private/etc/rndc.key: file not found
Jun 3 22:34:41 Gabrielle named[363]: /etc/com.apple.named.conf.proxy:7: couldn't install keys for command channel 127.0.0.1#54: file not found
Jun 3 22:34:41 Gabrielle named[363]: /etc/com.apple.named.conf.proxy:7: couldn't add command channel 127.0.0.1#54: file not found
Jun 3 22:34:41 Gabrielle lookupd[5901]: lookupd (version 324.2.1) starting - Thu Jun 3 22:34:41 2004
Jun 3 22:34:41 Gabrielle pppd[5831]: Connection terminated.
Jun 3 22:34:41 Gabrielle pppd[5831]: Connect time 89.7 minutes.
Jun 3 22:34:41 Gabrielle pppd[5831]: Sent 811137 bytes, received 18166300 bytes.
Jun 3 22:34:43 Gabrielle crashdump: Unable to determine CPSProcessSerNum pid: 5903 name: netstat
Jun 3 22:34:43 Gabrielle crashdump: Started writing crash report to: /Library/Logs/CrashReporter/netstat.crash.log
Jun 3 22:34:43 Gabrielle set-hostname[5909]: setting hostname to Gabrielle.local
Jun 3 22:34:43 Gabrielle crashdump: Finished writing crash report to: /Library/Logs/CrashReporter/netstat.crash.log
Jun 3 22:34:44 Gabrielle pppd[5831]: Serial link disconnected.

[Raven]

Just to confirm: I use teleport on several machines and have never run into issues with it. The app has its own bugs (it is a good beta, but still a beta), but nothing that affected any network services.
Also, wanted to know... Does this happen if you login with another user account ?

[yellow]

Weeeeiiiird.
/etc/com.apple.named.conf.proxy?
Anyone know if that is a normal file for a modem connection to create? I've never seen that file on any of my Macs.

What does "/Library/Logs/CrashReporter/netstat.crash.log" have to say for iteself?

[hayne]

Quote: Originally Posted by yellow Weeeeiiiird. /etc/com.apple.named.conf.proxy? Anyone know if that is a normal file for a modem connection to create?

The existence of that file is checked for in /System/Library/StartupItems/IPServices/IPServices:

if [ -a /etc/com.apple.named.conf.proxy ]
    then
          ConsoleMessage "Starting Internet address sharing"
          /usr/libexec/InternetSharing
fi

JonMntjy:
Do you have Internet Sharing enabled (under Sharing Preferences)?
It might be a good idea to turn it off, at least as a test.

[clallo]

Just wanted to let you know that I've been experiencing the same problem for some time with my G5. Only on wake from sleep...only cured by killing netsat. It started around 10.3.1, got better with 10.3.4, and came back hard with 10.3.5.

The only common thread that I can see between me and the original poster is that we are both running iBeez. It's a little app and demon that can wake up a machine at specified times. I use it to wake my machine up at 1 minute to 3:00am. My Carbon Copy Cloner sync script then runs at 3:00am. So I get a nightly automatic sync without having to keep my machine awake. It's pretty nifty actually. But I digress.

Just an FYI. HTH.

[griffman]

Ah, but I'm not running iBeez. The only thing I have in common (other than the G5) is that, like someone else here, I have a non-standard /etc/hosts file.

-rob.