'netstat' is invading my processors

[Sailfish]

Been trying everyday since above and still can't get the corruption of

netstat -rn

or any netstat processes hanging.

I haven't performed any hacks either. I'm thinking it's not our machines or the OS. But the net.

[JonMntjy]

OK, well I'm giving the sleep option a bash. It makes the most sense to me - my gut feeling is that it is some kind of sporadic race condition. I'll let you know how it pans out (which may take a few days, because I can't repeat the problem at will).

[hayne]

Someone else has pointed out to me that just before the line in the "set-hostname" script that invokes 'netstat -rn' there appears this:

if [ ! "${HOSTNAME:=-AUTOMATIC-}" = "-AUTOMATIC-" ] ; then
        hostname "${HOSTNAME}"
        exit 1
fi

which means that if you edit /etc/hostconfig and change the HOSTNAME line to specify the hostname you want (instead of -AUTOMATIC-), then the "set-hostname" script will never even get to the 'netstat' line.

This provides a solution to the problem unless you need your hostname to vary dynamically for some reason. I'd still be interested to see the results of experiments involving addition of a delay into the "set-hostname" script since that might help us (and maybe Apple) to understand why 'netstat -rn' is screwing up.

[Sailfish]

Ok I got success today, running netstat -rn while online, resulted in a long Bad Access list in Terminal.

Running iTunes music, Safari, Activity Monitor and InCrease w/4 Folding@homes (Nice), keeping my CPU's busy. Online 56K.

Dual 2 Ghz G5, 4.5Ghz RAM, ATI 9800 Pro SE.

Went offline and ran netstat -rn and now it's normal.

Went online, fully connected. Ran netstat -rn and now back to the Bad address.

Went offline and ran netstat -rn, it's fine.

Tried to get online, twice no dial tone.

Got online third try, netstat -rn is fine.

No hanging netstat process at any time. No editing or hacks. (sorry, just a user and abuser here)

Best Regards

Sailfish

[Sailfish]

Quote: Originally Posted by hayne Someone else has pointed out to me that just before the line in the "set-hostname" script that invokes 'netstat -rn' there appears this: if [ ! "${HOSTNAME:=-AUTOMATIC-}" = "-AUTOMATIC-" ] ; then hostname "${HOSTNAME}" exit 1 fi which means that if you edit /etc/hostconfig and change the HOSTNAME line to specify the hostname you want (instead of -AUTOMATIC-), then the "set-hostname" script will never even get to the 'netstat' line. This provides a solution to the problem unless you need your hostname to vary dynamically for some reason. I'd still be interested to see the results of experiments involving addition of a delay into the "set-hostname" script since that might help us (and maybe Apple) to understand why 'netstat -rn' is screwing up.

Ok I "pico /etc/hostconfig" but where do I get the information for the hostname from to replace -AUTOMATIC?

Do I replace all the -AUTOMATIC(s) or just the Hostname?

##
# This file is maintained by the system control panels
##

# Network configuration
HOSTNAME=-AUTOMATIC-
ROUTER=-AUTOMATIC-

# Services
AFPSERVER=-NO-
AUTHSERVER=-NO-
AUTOMOUNT=-YES-
CUPS=-YES-
IPFORWARDING=-NO-
IPV6=-YES-
MAILSERVER=-AUTOMATIC-
NETINFOSERVER=-AUTOMATIC-
NFSLOCKS=-AUTOMATIC-
NISDOMAIN=-NO-
RPCSERVER=-AUTOMATIC-
TIMESYNC=-NO-
QTSSERVER=-NO-
WEBSERVER=-NO-
SMBSERVER=-NO-
DNSSERVER=-NO-
COREDUMPS=-NO-
VPNSERVER=-NO-

Thanks.

[hayne]

Quote: Originally Posted by Sailfish Ok I "pico /etc/hostconfig" but where do I get the information for the hostname from to replace -AUTOMATIC? Do I replace all the -AUTOMATIC(s) or just the Hostname?

As I said above, you just change the HOSTNAME line.
It's up to you to decide what you want the hostname of your machine to be. Call it "fred", or "mybigmac", or whatever you want.

But be sure to keep a backup copy of the /etc/hostconfig file. And be careful when editing this file - mistakes will likely make your Mac unable to start up. (You would need to start up in "single user" mode to fix things.)

[FauxCaster]

I've tracked down a VERY similar problem on near 100% cpu usage by netstat to:

 610  ??  S      0:00.01 sh /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/set-hostname
  612  ??  S      0:00.00 sh /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/set-hostname
  613  ??  R    1318:13.54 netstat -rn
  614  ??  S      0:00.01 sed -n s/default [ ]*[^ ]*[ ]*[^ ]*[ ]*[^ ]*[ ]*[^ ]*[ ]*\([^ ]*\)[ ]*[^ ]*/\1/p

I'm on a G5 revA 2 Ghz (10.3.5)

[hayne]

Quote: Originally Posted by FauxCaster I've tracked down a VERY similar problem on near 100% cpu usage by netstat

It's not merely "similar" - it is the same problem. See post #43 of this thread: http://forums.macosxhints.com/showpo...6&postcount=43

[griffman]

The odd thing about the hostname question is ... mine's still on AUTOMATIC. And yet, after resetting the hosts file, I've had zero runaway netstat processes...

-rob.

[hayne]

Quote: Originally Posted by griffman The odd thing about the hostname question is ... mine's still on AUTOMATIC. And yet, after resetting the hosts file, I've had zero runaway netstat processes...

That's not too odd. It seems that having the "non-standard /etc/hosts file" is a precipitating factor for the 'netstat' bug.

The idea of setting the HOSTNAME in /etc/hostconfig is that if you do that, you should be able to have whatever you want in /etc/hosts and not get any problem from the "set-hostname" script since the troublesome 'netstat -rn' command will never get executed in this case.

But as an aside, if the reason you are changing your /etc/hosts file is to avoid web page ads, I would recommend instead the use of a web proxy like "Privoxy": http://www.privoxy.org/

[frankko]

This is defintely a weird issue. I wonder if it's several different problems that are all manifesting itself with netstat going haywire?

I haven't reset my etc/hosts file, and my hostconfig has always been AUTOMATIC, but I set my computer to not wake for Ethernet administrator access, and I haven't had the netstat problem since.

[griffman]

Nah, it wasn't ads (I just use Firefox and AdBlocker for that). It was for doing some quick and dirty web dev work with named sites...

-rob.

[FauxCaster]

The 100% thingy happened again, this time I was actually there to witness it. It took out Firefox and the Activity Monitor (both "unexpectedly quit). It seems it started right around 2am. I'm wondering if there is a 2:00am cron job. I noticed the directory service log was written to at 2:04am with the incredibly informative "Network transition occurred." And see this:

root     970  100.3 -0.0    18180    328  ??  R     2:04AM   3:21.45 netstat -rn

Here's the directory service log:

2004-08-30 13:48:06 PDT - DirectoryService 1.8.2 (v257.1) starting up...
2004-08-30 13:48:07 PDT - Plugin <Configure>, Version <1.6>, processed successfully.
2004-08-30 13:48:07 PDT - Plugin <NetInfo>, Version <1.6>, processed successfully.
2004-08-30 13:48:07 PDT - Plugin <LDAPv3>, Version <1.6.5>, processed successfully.
2004-08-30 13:48:07 PDT - Plugin <Search>, Version <1.6.1>, processed successfully.
2004-08-30 13:48:07 PDT - Plugin "Active Directory", Version "1.0.4", is set to load lazily.
2004-08-30 13:48:07 PDT - Plugin "AppleTalk", Version "1.1", is set to load lazily.
2004-08-30 13:48:07 PDT - Plugin "BSD", Version "1.1", is set to load lazily.
2004-08-30 13:48:07 PDT - Plugin "PasswordServer", Version "2.0.3", is set to load lazily.
2004-08-30 13:48:07 PDT - Plugin "Rendezvous", Version "1.1", loaded successfully.
2004-08-30 13:48:07 PDT - Plugin "SLP", Version "1.1", is set to load lazily.
2004-08-30 13:48:07 PDT - Plugin "SMB", Version "1.1.2", is set to load lazily.
2004-08-30 13:48:07 PDT - Registered node ~Configure
2004-08-30 13:48:07 PDT - Plug-in Configure state is now active.
2004-08-30 13:48:07 PDT - Plug-in LDAPv3 state is now active.
2004-08-30 13:48:07 PDT - Registered node ~NetInfo~DefaultLocalNode
2004-08-30 13:48:07 PDT - Plug-in NetInfo state is now active.
2004-08-30 13:48:07 PDT - Plug-in Rendezvous state is now active.
2004-08-30 13:48:07 PDT - Registered Locally Hosted Node ~NetInfo~DefaultLocalNode
2004-08-30 13:48:08 PDT - Network transition occurred.
2004-08-30 13:48:08 PDT - Network transition occurred.
2004-08-30 13:48:08 PDT - Registered node ~Search
2004-08-30 13:48:08 PDT - Registered node ~Search~Contacts
2004-08-30 13:48:08 PDT - Registered node ~Search~Network
2004-08-30 13:48:08 PDT - Plug-in Search state is now active.
2004-08-30 13:48:10 PDT - Plug-in SLP state is now active.
2004-08-30 13:48:10 PDT - Plugin "SLP", Version "1.1", loaded on demand successfully.
2004-08-30 13:48:10 PDT - Plug-in SMB state is now active.
2004-08-30 13:48:10 PDT - Plugin "SMB", Version "1.1.2", loaded on demand successfully.
2004-08-30 13:48:10 PDT - Plug-in AppleTalk state is now active.
2004-08-30 13:48:10 PDT - Plugin "AppleTalk", Version "1.1", loaded on demand successfully.
2004-08-30 19:40:41 PDT - Network transition occurred.
2004-08-30 21:21:45 PDT - Network transition occurred.
2004-08-30 21:21:50 PDT - Network transition occurred.
2004-08-30 21:21:50 PDT - Network transition occurred.
2004-08-31 02:04:34 PDT - Network transition occurred.
2004-08-31 02:04:34 PDT - Network transition occurred.
2004-08-31 02:04:53 PDT - Network transition occurred.
2004-08-31 02:04:53 PDT - Network transition occurred.

The two crash logs of Activity Monitor and Firefox seem even less informative ro my untrained eyes.

[Sailfish]

Quote: I'm wondering if there is a 2:00am cron job

The Periodic Daily is at 3:15 AM

" Weekly is Sat (or is it Sunday?) 4:30 AM

" First day of the month is at 5:30 AM

For the standard scripts. Unless your clock is off or you changed the times.

The bug definably affects broadband users and 56kers alike.

Question is, is it only affecting G5 owners?

[Raven]

Doesn't it sound weird to anyone that this problem is only starting to appear now, even though lots of people have modifyed host files since G5s came out ?

[griffman]

It was definitely one of the 10.3 "dot updates" that started the problem. I don't recall which one...

-rob.

[Raven]

Just a hunch, but maybe between all the people who have this issue we can try to pinpoint a date at which it started and see what update caused the issue to start with. Maybe it would help understand why the problem seems to be somewhat inconsistent.

[hayne]

Quote: Originally Posted by griffman It was definitely one of the 10.3 "dot updates" that started the problem.

The following script shows that netstat was changed in the 10.3.3 update.

#!/bin/sh

# This script searches the bom files in /Library/Receipts
# for the component name given as a command line argument
# It will show the info about that component from the bom file
# followed by the name of the pkg that contained that component
# Cameron Hayne (macdev@hayne.net), Sept 2004
 
name=$1
cd /Library/Receipts
for pkg in *.pkg; do
    find "$pkg" -name '*.bom' -print0 | xargs -0 lsbom | grep "$name"
    if [ $? = 0 ]; then
	echo "$pkg"
    fi
done

[Sailfish]

I remember installing 10.3x on a friends eMac, then coming back and updating to 10.3.5. I know I had the netstat hanging process on one or both of these updates.

This is a eMac 800 Mhz, 56K, a fresh cd install and later a software update, not a clone from a G5.

So it may seem it's not restricted to G5's.

Next time I'm up North I'll check the install and crashreporter logs.

[JonMntjy]

OK - the sleep doesn't work. Netstat is there again, hogging 100%.
I'm away for the next week- when I get back I'll hack the script to avoid running netstat as suggested in this thread.