'netstat' is invading my processors - Page 3

Sailfish · 08-23-2004, 05:31 PM

Hi all, been through this with the netstat process.

I had it happen to me a few times and this is the "extra's" I run.

X Resource Graph, Little Snitch, Backlight, MenuMeters.

I just started running MenuMeters and got the hanging netstat process right away, so then I shut that off and got it again while running X Resource Graph (it connects and monitors net activity)

So I shut anything net related in X Resource Graph (So far so good) and sent a email to the programmer:

Quote:


	I'm not sure what is causing the Netstat process to hog 50% of a CPU on your machine. XRG is entirely independent of other applications and doesn't call any other processes to gather it's statistics. The only time XRG will open other applications is when the user selects menu options like "Open Activity Monitor" in the CPU contextual menu. XRG does use similar methods to access network statistics as netstat does, so it's possible if something else is using netstat that they might conflict with each other. I'll keep my eye out to see it happens on my machine here Regards, Mike

So nothing there.

I've talked to others about this.

Some seem to think it's something to do with software the phone company uses and conflicts with our computers using either DSL or 56K.

BTW I have 56K, but running only Backlight, Little Snitch and the non-net parts of X Resource Graph, I haven't had a problem since.

Also another person mentioned that phone lines are unshielded, to keep them away from powered lines as these put off a magnetic field that may be interfering with the line.

http://discussions.info.apple.com/we...3377@.689909d4

http://discussions.info.apple.com/we...3377@.6896a34f

Take care.

Sailfish
Folding@home Evangelist for Team Mac OS X
Moderator G5support.com

frankko · 08-23-2004, 07:04 PM

I'm not running MM, Little Snitch, or any of the other Utilities that have been mentioned as potential culprits (including iBeez).

I do have a dual G5, it has 4.5GB of RAM, and I have a non-standard /etc/hosts file (but haven't touched /etc/hostsconfig), and netstat only goes nuts after I wake from sleep.

It used to, actually.

I mentioned this in the comments of the article posted today that, in my case, I was able to stop the problem by disabling the "wake for ethernet network administrator access" in the Energy Saver pref pane. Whether or not that works for others is anybody's guess. But it worked for me.

hayne · 08-23-2004, 07:12 PM

Well, if you look back a few posts, JonMntjy found out where this netstat is being called from. It is being invoked by 'configd' which is the daemon that watches for changes in system configuration (e.g. network connection) via the script
/System/Library/SystemConfiguration/Kicker.bundle/
Contents/Resources/set-hostname
(script path broken over two lines to avoid a long line)

It is evident from its name that this script sets the hostname of the machine.
In that script you can see the line where 'netstat' is being called:

netstat -rn | sed -n 's/default [ ]*[^ ]*[ ]*[^ ]*[ ]*[^ ]*[ ]*[^ ]*[ ]*\([^ ]*\)[ ]*[^ ]*/\1/p'

What this is trying to do is extract the name of the networking "interface" (e.g. en0, en1, ppp) that is currently being used.

I don't know why it is failing, or why it would continue to run if it failed.
Perhaps the hostname script repeats if it fails?
Maybe the common element is something to do with the way your hostnames are configured? Or the way that your networking is configured? (Several people seemed to be using dialup -is it possible that all of you who have had this problem are using dialup?)

If this was happening on my machine, I would edit the above script to put in more error checking & debugging info, maybe saving the info to a log file that I could look at later.
And I might consider changing that line that calls netstat to some other way of determining the interface, even hard-coding it if it never varied in my configuration.
For example, here's a shell script that gets the name of the currently active network interface. You could save this to a file in an appropriate place and replace the netstat line in the hostname script with a call to this script:

Code:

#!/bin/sh

for iface in  `ifconfig -lu` ; do
    case $iface in
    lo*)     continue ;;
    esac
    ifconfig $iface | grep -q 'inet ' && echo $iface
done

griffman · 08-23-2004, 07:32 PM

It seems it's the -r option that causes the issue, at least on my machine. netstat runs as expected, netstat -n runs as expected, but netstat -rn leads to a whole bunch of "netstat: kvm_read: Bad address" errors, followed by a segmentation fault. I tested this just by running netstat directly in the Terminal.

The -r option is supposed to show the routing tables, according to netstat's man page. I've now edited my hosts file to remove the non-standard entries, and I'll reboot in a few minutes to reset everything and see what happens. I'll post back...

-rob.

Sailfish · 08-23-2004, 09:56 PM

I get the bunch of bad addresses when doing the netstat -rn as well. Doesn't seem to occur when I'm off dial-up.

If that helps any.

JonMntjy · 08-24-2004, 06:42 AM

Yes, I don't use iBeez (or whatever it is called) either. I do have a non-standard etc/hosts file (mapping all advert sites to 127.0.0.1). I think Personal Web Sharing does influence its frequency, but I have never been able to nail it down to anything in particular. It's incredibly irritating as it's the only thing wrong with my mac

Well, that and the fact that I have to go the bottom right corner of a window to resize

rvamerongen · 08-24-2004, 07:18 AM

Hi Guys

Did someone file a bug at apple?

If not please do!!

radar.apple.com

if you dont have a adc membership look here, its free.

https://connect.apple.com/cgi-bin/We...3K2kY3JVMr/0.0

greetz

griffman · 08-24-2004, 08:47 AM

Day Two of my experiment. The machine slept all night, and when I awoke it this morning ... no runaway netstat process. Also, netstat -rn works as expected.

Now, I don't *always* have the netstat runaway issue, so I'll need a few more wake/sleep cycles to see if I've really cured it. But if it's gone, then it looks like it's for sure related to (a) Dual G5 machines, and (b) non-standard hosts files. All I did yesterday was comment out the entries that aren't there on a stock machine, then restarted.

As an aside, it's not just a dialup issue, either, as I'm on broadband. I'll update here again tomorrow, after a few more wake/sleep cycles...

-rob.

hayne · 08-24-2004, 09:44 AM

So the problem does seem to be related to waking from sleep?
Does it happen right away after waking from sleep? Or does it happen many minutes later? It seems to me that the bug might be an order dependence in the startup items - maybe the set-hostname script is running too soon, before the networking has settled down.

griffman · 08-24-2004, 11:22 AM

It happens basically as soon as I have the screen back on wake from sleep. Since I hardly ever shut down, that's the only time I see it. I've never seen it just 'happen' when the machine is on and being used, though. Just waking up.

-rob.

hayne · 08-24-2004, 12:59 PM

I would venture to guess that if you added a delay in that set-hostname script, it might solve all the problems.
E.g. add a line:

sleep 5

before the line that calls 'netstat'.
The idea is to give the network time to settle down before the script queries it with 'netstat'.

Of course it would be good to narrow down the causes of the problem and submit a bug report to Apple as someone previously suggested.

[edit] If this problem seems to be limited to G5's, it might simply be because the G5's are fast enough that some parts of the wakeup process complete too fast - i.e. faster than the programmers expected - and hence other parts are not yet ready. This is known as a "race condition" and such problems are usually intermittent since they depend on small timing differences.
[/edit]

catmagnum · 08-24-2004, 01:06 PM

I'm running a single 1.8 G5 and I have been having netstat trouble for a few months now. I haven't edited any files, but I did have a CCC cron job running. That has been removed now. I also use Macaroni, a pref pane which runs the nightly, weekly and monthly Cron cleanup jobs if my machine is asleep overnight.

I am on a cable modem with a router and hub serving a home network.

Nothing else to add. Just some more stats for you clever guys.

jiclark · 08-24-2004, 01:16 PM

Thought I'd check back in as well. I was part of the original discussion on this, and I'm glad to see that it appears that none of the utilities I'm running appear to be the root cause of the problem. I have not, to my knowledge, edited my hosts file, and would love to have someone tell us how to find this file and possibly edit it in the event that one of you whizzes figures out how to eliminate the problem. Also, if it would be helpful, I could post the contents of that file for you to peruse. Just need a little help with where it is (and what it does actually, as well?).

Thanks all!

John

Sailfish · 08-24-2004, 03:36 PM

I have submitted a detailed bug report, including log files and hardware specs to Apple several weeks back.

BTW I ran netstat -rn just now several times and it's fine. WTF?

geohar · 08-25-2004, 04:32 AM

I'm wondering if the following is true:

configd sees a configuration change and kicks off the set-hostname script which calls netstat -rn . As part of that process some networking change is invoked (dial-up or dsl login etc). That causes a configd change, which kicks a set-hostname script. The first gets orphaned or goes mad because the network config changes under it's feet....

If that's the case, it might be possible to track the bug by kicking the netstat line on it's own and manually changing the configuration whilst it happens.

[Edit]
I'm on remote connection right now, so I can't try it or I'll loose my link, but doing the netstat -rn followed by a ctrl-z to pause the process might give time to change the config
[/Edit]

griffman · 08-27-2004, 03:52 PM

Well, several days have passed, and since modifying the /etc/hosts file back to stock form, not once has netstat gone into "run away!" mode. Not sure why, but at least in my case, the hosts file clearly seemed to be causing the problem. I may experiment with adding the delay to the script as suggested above...

-rob.

jiclark · 08-27-2004, 04:03 PM

Could someone post the contents of the "stock" /etc/hosts file? I'd like to compare it to mine, and then edit mine if necessary. Also, would someone be willing to clearly show how I would go about editing the file with something like the delay that Rob (and others) mentioned???

Many thanks!!
John

yellow · 08-27-2004, 04:12 PM

From a 10.3.4 box:

Code:

yellow% more /etc/hosts
##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1       localhost
255.255.255.255 broadcasthost
::1             localhost

hayne · 08-27-2004, 04:23 PM

Quote:

Originally Posted by jiclark


	would someone be willing to clearly show how I would go about editing the file with something like the delay that Rob (and others) mentioned???

This is not something that you want to be experimenting with unless you are already pretty familiar with how to do this and how to recover from problems if it doesn't work. Otherwise you might get your Mac into an state where it won't start up. Maybe best to wait for Rob to do the experimenting.

jiclark · 08-27-2004, 07:56 PM

Thanks Yellow and hayne,

I took a gander at my hosts file; it looks exactly like Yellow's. I guess I'll just keep my eye on this thread, and decide what to do once we have more info...

Later,
John

08-23-2004, 07:12 PM	#43
hayne Site Admin Join Date: Jan 2002 Location: Montreal Posts: 32,473	Well, if you look back a few posts, JonMntjy found out where this netstat is being called from. It is being invoked by 'configd' which is the daemon that watches for changes in system configuration (e.g. network connection) via the script /System/Library/SystemConfiguration/Kicker.bundle/ Contents/Resources/set-hostname (script path broken over two lines to avoid a long line) It is evident from its name that this script sets the hostname of the machine. In that script you can see the line where 'netstat' is being called: netstat -rn \| sed -n 's/default [ ][^ ][ ][^ ][ ][^ ][ ][^ ][ ]\([^ ]\)[ ][^ ]/\1/p' What this is trying to do is extract the name of the networking "interface" (e.g. en0, en1, ppp) that is currently being used. I don't know why it is failing, or why it would continue to run if it failed. Perhaps the hostname script repeats if it fails? Maybe the common element is something to do with the way your hostnames are configured? Or the way that your networking is configured? (Several people seemed to be using dialup -is it possible that all of you who have had this problem are using dialup?) If this was happening on my machine, I would edit the above script to put in more error checking & debugging info, maybe saving the info to a log file that I could look at later. And I might consider changing that line that calls netstat to some other way of determining the interface, even hard-coding it if it never varied in my configuration. For example, here's a shell script that gets the name of the currently active network interface. You could save this to a file in an appropriate place and replace the netstat line in the hostname script with a call to this script: Code: #!/bin/sh for iface in `ifconfig -lu` ; do case $iface in lo) continue ;; esac ifconfig $iface \| grep -q 'inet ' && echo $iface done Last edited by hayne; 08-23-2004 at 07:37 PM.*

08-23-2004, 09:56 PM	#45
Sailfish Prospect Join Date: Aug 2004 Posts: 12	I get the bunch of bad addresses when doing the netstat -rn as well. Doesn't seem to occur when I'm off dial-up. If that helps any. Last edited by Sailfish; 08-23-2004 at 09:58 PM.

08-24-2004, 07:18 AM	#47
rvamerongen Prospect Join Date: Mar 2003 Posts: 10	did someone file the Bug? Hi Guys Did someone file a bug at apple? If not please do!! radar.apple.com if you dont have a adc membership look here, its free. https://connect.apple.com/cgi-bin/We...3K2kY3JVMr/0.0 greetz

08-24-2004, 12:59 PM	#51
hayne Site Admin Join Date: Jan 2002 Location: Montreal Posts: 32,473	I would venture to guess that if you added a delay in that set-hostname script, it might solve all the problems. E.g. add a line: sleep 5 before the line that calls 'netstat'. The idea is to give the network time to settle down before the script queries it with 'netstat'. Of course it would be good to narrow down the causes of the problem and submit a bug report to Apple as someone previously suggested. [edit] If this problem seems to be limited to G5's, it might simply be because the G5's are fast enough that some parts of the wakeup process complete too fast - i.e. faster than the programmers expected - and hence other parts are not yet ready. This is known as a "race condition" and such problems are usually intermittent since they depend on small timing differences. [/edit] Last edited by hayne; 08-24-2004 at 01:14 PM.

08-25-2004, 04:32 AM	#55
geohar Prospect Join Date: Aug 2004 Location: UK Posts: 11	I'm wondering if the following is true: configd sees a configuration change and kicks off the set-hostname script which calls netstat -rn . As part of that process some networking change is invoked (dial-up or dsl login etc). That causes a configd change, which kicks a set-hostname script. The first gets orphaned or goes mad because the network config changes under it's feet.... If that's the case, it might be possible to track the bug by kicking the netstat line on it's own and manually changing the configuration whilst it happens. [Edit] I'm on remote connection right now, so I can't try it or I'll loose my link, but doing the netstat -rn followed by a ctrl-z to pause the process might give time to change the config [/Edit] Last edited by geohar; 08-25-2004 at 04:36 AM.

08-23-2004, 07:04 PM	#42
frankko All Star Join Date: Jan 2002 Location: New York, NY Posts: 587	I'm not running MM, Little Snitch, or any of the other Utilities that have been mentioned as potential culprits (including iBeez). I do have a dual G5, it has 4.5GB of RAM, and I have a non-standard /etc/hosts file (but haven't touched /etc/hostsconfig), and netstat only goes nuts after I wake from sleep. It used to, actually. I mentioned this in the comments of the article posted today that, in my case, I was able to stop the problem by disabling the "wake for ethernet network administrator access" in the Energy Saver pref pane. Whether or not that works for others is anybody's guess. But it worked for me.

08-23-2004, 07:32 PM	#44
griffman MVP Join Date: Dec 2001 Location: Portland, OR Posts: 1,472	It seems it's the -r option that causes the issue, at least on my machine. netstat runs as expected, netstat -n runs as expected, but netstat -rn leads to a whole bunch of "netstat: kvm_read: Bad address" errors, followed by a segmentation fault. I tested this just by running netstat directly in the Terminal. The -r option is supposed to show the routing tables, according to netstat's man page. I've now edited my hosts file to remove the non-standard entries, and I'll reboot in a few minutes to reset everything and see what happens. I'll post back... -rob.

08-24-2004, 06:42 AM	#46
JonMntjy Prospect Join Date: Jun 2004 Posts: 10	Yes, I don't use iBeez (or whatever it is called) either. I do have a non-standard etc/hosts file (mapping all advert sites to 127.0.0.1). I think Personal Web Sharing does influence its frequency, but I have never been able to nail it down to anything in particular. It's incredibly irritating as it's the only thing wrong with my mac Well, that and the fact that I have to go the bottom right corner of a window to resize

08-24-2004, 08:47 AM	#48
griffman MVP Join Date: Dec 2001 Location: Portland, OR Posts: 1,472	Day Two of my experiment. The machine slept all night, and when I awoke it this morning ... no runaway netstat process. Also, netstat -rn works as expected. Now, I don't always have the netstat runaway issue, so I'll need a few more wake/sleep cycles to see if I've really cured it. But if it's gone, then it looks like it's for sure related to (a) Dual G5 machines, and (b) non-standard hosts files. All I did yesterday was comment out the entries that aren't there on a stock machine, then restarted. As an aside, it's not just a dialup issue, either, as I'm on broadband. I'll update here again tomorrow, after a few more wake/sleep cycles... -rob.

08-24-2004, 09:44 AM	#49
hayne Site Admin Join Date: Jan 2002 Location: Montreal Posts: 32,473	So the problem does seem to be related to waking from sleep? Does it happen right away after waking from sleep? Or does it happen many minutes later? It seems to me that the bug might be an order dependence in the startup items - maybe the set-hostname script is running too soon, before the networking has settled down.

08-24-2004, 11:22 AM	#50
griffman MVP Join Date: Dec 2001 Location: Portland, OR Posts: 1,472	It happens basically as soon as I have the screen back on wake from sleep. Since I hardly ever shut down, that's the only time I see it. I've never seen it just 'happen' when the machine is on and being used, though. Just waking up. -rob.

08-24-2004, 01:06 PM	#52
catmagnum Prospect Join Date: Jul 2003 Posts: 12	I'm running a single 1.8 G5 and I have been having netstat trouble for a few months now. I haven't edited any files, but I did have a CCC cron job running. That has been removed now. I also use Macaroni, a pref pane which runs the nightly, weekly and monthly Cron cleanup jobs if my machine is asleep overnight. I am on a cable modem with a router and hub serving a home network. Nothing else to add. Just some more stats for you clever guys.

08-24-2004, 01:16 PM	#53
jiclark Major Leaguer Join Date: Jan 2002 Location: San Juan Mts, Colo. Posts: 283	Thought I'd check back in as well. I was part of the original discussion on this, and I'm glad to see that it appears that none of the utilities I'm running appear to be the root cause of the problem. I have not, to my knowledge, edited my hosts file, and would love to have someone tell us how to find this file and possibly edit it in the event that one of you whizzes figures out how to eliminate the problem. Also, if it would be helpful, I could post the contents of that file for you to peruse. Just need a little help with where it is (and what it does actually, as well?). Thanks all! John

08-24-2004, 03:36 PM	#54
Sailfish Prospect Join Date: Aug 2004 Posts: 12	I have submitted a detailed bug report, including log files and hardware specs to Apple several weeks back. BTW I ran netstat -rn just now several times and it's fine. WTF?

08-27-2004, 03:52 PM	#56
griffman MVP Join Date: Dec 2001 Location: Portland, OR Posts: 1,472	Well, several days have passed, and since modifying the /etc/hosts file back to stock form, not once has netstat gone into "run away!" mode. Not sure why, but at least in my case, the hosts file clearly seemed to be causing the problem. I may experiment with adding the delay to the script as suggested above... -rob.

08-27-2004, 04:03 PM	#57
jiclark Major Leaguer Join Date: Jan 2002 Location: San Juan Mts, Colo. Posts: 283	Could someone post the contents of the "stock" /etc/hosts file? I'd like to compare it to mine, and then edit mine if necessary. Also, would someone be willing to clearly show how I would go about editing the file with something like the delay that Rob (and others) mentioned??? Many thanks!! John

08-27-2004, 07:56 PM	#60
jiclark Major Leaguer Join Date: Jan 2002 Location: San Juan Mts, Colo. Posts: 283	Thanks Yellow and hayne, I took a gander at my hosts file; it looks exactly like Yellow's. I guess I'll just keep my eye on this thread, and decide what to do once we have more info... Later, John