Hi,
I installed the Docker Droplet of DO and loaded a modest docker-compose service. After a week of working ok and uninterrupted for 8 days.
Suddenly cpu fired up to 100% usage and I couldnt access the droplet. After reboot and password reset, I launched the process again and the same happed in a couple of hours.
The second time, I could enter to the droplet and doesn’t seems to be a hack on the machine. The process using the cpu was the kswapd0
and this is a known issue with the memory swap management but not very clearly solved in Ubuntu machines.
Furthermore, this is not really a machine, and I don’t know (and probably I don’t need to know) how is configured.
As this maybe is an trouble shared with other users I ask for some recommendation. Thanks in advance, Willy Pregliasco
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Just for the record: finally I the rebuild the project with the new swap configuration and everything it is going smoothing and with a 0.65% of CPU.
I learned that when the project runs low in memory, the operatives system can get corrupted and a fresh new start is a good advice.
Thanks for the help. See you in next troubleshot !
Willy
Hi there @willypregliasco,
It sounds like that you might not have enough RAM and the processes are moved to SWAP too frequently which could cause the high CPU load.
There are a few options that you can configure that will have an impact on your system’s performance when dealing with swap.
What I could suggest is tweaking your SWAP settings as described in this tutorial here:
https://www.digitalocean.com/community/tutorials/how-to-add-swap-space-on-ubuntu-16-04#tweak-your-swap-settings
Let me know how it goes!
If you are still facing the problem, can you share how much RAM you and how much SWAP space you’ve got as well? You can do that with this command here:
Hope that this helps! Regards, Bobby
I fixed this … it’s not a swap issue, it’s a coinminer !!
This will find which user has it installed:
find /home -name kswapd0
Also it reinstalls itself, look in /var/spool/crontab/<the user> Also it installs keys in other users’ authorized_keys files.
Disable SSH from outside connections, back up your personal files, then wipe the disk and reinstall the OS.
Here’s where I found my helpful info:
https://askubuntu.com/questions/1115770/crond64-tsm-virus-in-ubuntu
Good luck!!
Hi @bobbyiliev !
Thank you for your fast and acurate response.
The link you sent me is very clear and I could change the swap parameters understanding what I was doing.
Before the changes my system had:
Then, I changed everything and leaved as:
BUT…
on reboot, again I have the
kswapd0with 98% of the CPU.Please, tell me if you have any new idea. I think the system may be corrupted and it would be better to begin with a fresh new install. What do you think?
Thanks, is good to know there is somebody out there trying to help, I really appeciate that.