0

There's a process that's running that I'm trying to investigate why its running and what its doing. The server is a Linux Ubuntu server running on AWS. Running 16.04.

The process in question is:

root 829 0.0 0.0 16116 2888 ? Ss Jun19 0:04 /var/tmp/cloud-init/cloud-init-dhcp-zaislidv/dhclient -1 -v -

When I run lsof -p 829:

sudo lsof -p 829
COMMAND  PID USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
dhclient 829 root  cwd    DIR              259,1     4096       2 /
dhclient 829 root  rtd    DIR              259,1     4096       2 /
dhclient 829 root  txt    REG              259,1   487248 1536424 /var/tmp/cloud-init/cloud-init-dhcp-zaislidv/dhclient (deleted)
dhclient 829 root  mem    REG              259,1    47600    1993 /lib/x86_64-linux-gnu/libnss_files-2.23.so
dhclient 829 root  mem    REG              259,1    14608    1982 /lib/x86_64-linux-gnu/libdl-2.23.so
dhclient 829 root  mem    REG              259,1  1868984    1980 /lib/x86_64-linux-gnu/libc-2.23.so
dhclient 829 root  DEL    REG              259,1             2123 /lib/x86_64-linux-gnu/libisc-export.so.160.0.0
dhclient 829 root  DEL    REG              259,1             2125 /lib/x86_64-linux-gnu/libdns-export.so.162.1.3
dhclient 829 root  mem    REG              259,1   162632    1978 /lib/x86_64-linux-gnu/ld-2.23.so
dhclient 829 root    0u   CHR                1,3      0t0       6 /dev/null
dhclient 829 root    1u   CHR                1,3      0t0       6 /dev/null
dhclient 829 root    2u   CHR                1,3      0t0       6 /dev/null
dhclient 829 root    3u  unix 0xffff880036debc00      0t0   12925 type=DGRAM
dhclient 829 root    5u  pack              12942      0t0     ALL type=SOCK_RAW
dhclient 829 root    6u  IPv4              12943      0t0     UDP *:bootpc

Out of 200 servers this is the only one running this process.

I enter the /var/tmp/cloud-init dir and its empty of course and I don't see this executable even in there.

Any insight on what it is and where it may be configured to run at?

Thanks!

2
  • Impossible to answer, still. Does it generate any traffic on port 68?
    – tink
    Dec 13, 2018 at 5:11
  • Guess, from he name: It's whatever AWS is using to configure network interfaces of this instance, via DHCP. It's still running, because it may need to renew the DHCP lease. You don't see the file, because after starting it this instance has removed it.
    – dirkt
    Dec 13, 2018 at 11:08

0

You must log in to answer this question.

Browse other questions tagged .