3

My Ubuntu 10.04 Lucid virtual machine is saying it's at 100% CPU usage... but all I'm running is Thunderbird. According to top, CPU usage should be ~25.9%... How do I interpret this conflicting output from top?

top - 13:55:26 up  3:35,  4 users,  load average: 3.03, 2.59, 2.48
Tasks: 178 total,   1 running, 177 sleeping,   0 stopped,   0 zombie
Cpu(s): 16.0%us, 79.7%sy,  0.0%ni,  0.0%id,  0.0%wa,  1.3%hi,  3.0%si,  0.0%st
Mem:    509364k total,   479108k used,    30256k free,     3092k buffers
Swap:  2096440k total,    58380k used,  2038060k free,   225116k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                                                    
 7708 jnet      20   0  480m 109m  17m S 18.4 22.1  21:59.14 thunderbird-bin                                                                                                                            
 4615 jnet      20   0  5488 1268 1040 S  2.3  0.2   5:00.03 nx-rootless-ses                                                                                                                            
 7124 jnet      20   0 56688  27m 4812 S  2.0  5.5   6:35.09 nxagent                                                                                                                                    
 6724 nx        20   0  9628 1400  636 S  1.6  0.3   3:26.59 sshd                                                                                                                                       
30106 root      20   0  2544 1236  908 R  0.7  0.2   0:00.33 top                                                                                                                                        
   19 root      20   0     0    0    0 S  0.3  0.0   0:22.45 ata/0                                                                                                                                      
   38 root      20   0     0    0    0 S  0.3  0.0   0:05.53 scsi_eh_1                                                                                                                                  
  345 root      20   0     0    0    0 S  0.3  0.0   0:04.72 kjournald                                                                                                                                  
 1719 root      20   0  3260 1192  944 S  0.3  0.2   0:17.36 vmware-guestd                                                                                                                              
    1 root      20   0  2804 1356  940 S  0.0  0.3   0:01.99 init                                                                                                                                       
    2 root      20   0     0    0    0 S  0.0  0.0   0:00.01 kthreadd                                                                                                                                   
    3 root      RT   0     0    0    0 S  0.0  0.0   0:00.00 migration/0                                                                                                                                
    4 root      20   0     0    0    0 S  0.0  0.0   0:00.15 ksoftirqd/0                                                                                                                                
    5 root      RT   0     0    0    0 S  0.0  0.0   0:00.00 watchdog/0
...

Specifically I'm referring to the fact that the CPU usage totals show 0% idle time:

Cpu(s): 16.0%us, 79.7%sy,  0.0%ni,  0.0%id,  0.0%wa,  1.3%hi,  3.0%si,  0.0%st

Yet when adding up the percentages in the %CPU column I get 25.9%, not 100%!

EDIT: Below is the output of top on the host, showing that my virtual machine is consuming 92.1% of CPU time:

top - 14:19:40 up 6 days, 23:17,  2 users,  load average: 5.48, 4.62, 4.25
Tasks: 149 total,   1 running, 148 sleeping,   0 stopped,   0 zombie
Cpu(s):  2.0%us, 89.4%sy,  0.0%ni,  0.0%id,  4.3%wa,  0.7%hi,  3.7%si,  0.0%st
Mem:   1286008k total,  1256240k used,    29768k free,      812k buffers
Swap:  1048568k total,    35908k used,  1012660k free,  1026048k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                                                    
21057 jnet      10 -10 1048m 417m 389m S 92.1 33.2 259:15.70 vmware-vmx                                                                                                                                 
20218 jnet      20   0 27264 4188 3032 S  0.7  0.3   3:19.37 multiload-apple                                                                                                                            
   23 root      15  -5     0    0    0 S  0.3  0.0   7:39.02 kswapd0                                                                                                                                    
   59 root      15  -5     0    0    0 D  0.3  0.0   3:04.76 kjournald2                                                                                                                                 
 1156 root      15  -5     0    0    0 S  0.3  0.0   2:22.05 kondemand/0                                                                                                                                
18619 jnet      20   0  2544  956  712 R  0.3  0.1   5:56.40 top                                                                                                                                        
19780 root      20   0  215m  22m 6760 S  0.3  1.8   2:23.78 Xorg                                                                                                                                       
20039 jnet      20   0 56512  10m 4452 S  0.3  0.8   2:13.21 compiz                                                                                                                                     
20285 jnet      20   0 93900  23m 5324 S  0.3  1.9   3:37.65 vmware                                                                                                                                     
21016 jnet      20   0 63304 6644 3620 S  0.3  0.5   0:21.08 vmware-unity-he                                                                                                                            
    1 root      20   0  2008  340  284 S  0.0  0.0   0:01.05 init                

EDIT2: It must have been some driver issue, because a reboot cleared it up. How odd..

2
  • Why didn't "vmware-vmx" show up during the first invocation of top? May 26, 2010 at 22:51
  • @Stefan: The first top output was from within the VM. The second was from the host.
    – Josh
    May 26, 2010 at 23:27

2 Answers 2

3

i'm not 100% sure, but it looks like a kernel driver or the kernel itself is consuming the rest.

in the cpu line you see "79.7%sy".

maybe one of the virtual machine drivers is running wild? you can check on the host system what the values are. if there is more idle time maybe this is expected behavior (that the virtual machine never has idle time because only the host shows it).

2
  • I just edited my question and posted the output from top on the host. The virtual machine is consuming 90-98% of the CPU time for the physical system...
    – Josh
    May 25, 2010 at 18:13
  • Is there any way for me to find out what specifically the kernel/drivers are doing with their 79.7% of my CPU time? :-)
    – Josh
    May 25, 2010 at 18:21
1

si = software interrupts sy = system/kernel us = userspace

What's odd is that your system/kernel seems to be using most of your cpu power. If IDLE showed it was taking up a lot that wouldn't be strange, but this is system. My best guess is that this could be related to how the virtual machine's CPU works, maybe it reports states in a different way. If you have another ubuntu virtual machine handy try running top on it and see if you get the same sort of results.
If that's not the problem then the only thing I can think of is a rootkit. A rootkit could cause a lot of kernel activity in order to hide itself, if it was coded poorly. Good luck.

2
  • I've had this VM for over a year and it only just started acting like this... so maybe a rootkit could be the cause. Any idea how I'd go about searching for one?
    – Josh
    May 25, 2010 at 18:29
  • 1
    Rootkits operate by changing requests or the results of requests. You can detect them if the results you get from a query and it differs from what the truth is. For example if a process were hiding itself and you were to ask the OS how many processes there were, it might return the actual number -1 (for the hidden one). You can detect rootkits by exposing discrepancies, if the VM can tell you the number of active processes then you can locate the discrepancy. Try this tool to detect rootkits howtoforge.com/howto_chkrootkit_portsentry
    – Daisetsu
    May 25, 2010 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .