There's a process that's running that I'm trying to investigate why its running and what its doing. The server is a Linux Ubuntu server running on AWS. Running 16.04.
The process in question is:
root 829 0.0 0.0 16116 2888 ? Ss Jun19 0:04 /var/tmp/cloud-init/cloud-init-dhcp-zaislidv/dhclient -1 -v -
When I run lsof -p 829:
sudo lsof -p 829
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
dhclient 829 root cwd DIR 259,1 4096 2 /
dhclient 829 root rtd DIR 259,1 4096 2 /
dhclient 829 root txt REG 259,1 487248 1536424 /var/tmp/cloud-init/cloud-init-dhcp-zaislidv/dhclient (deleted)
dhclient 829 root mem REG 259,1 47600 1993 /lib/x86_64-linux-gnu/libnss_files-2.23.so
dhclient 829 root mem REG 259,1 14608 1982 /lib/x86_64-linux-gnu/libdl-2.23.so
dhclient 829 root mem REG 259,1 1868984 1980 /lib/x86_64-linux-gnu/libc-2.23.so
dhclient 829 root DEL REG 259,1 2123 /lib/x86_64-linux-gnu/libisc-export.so.160.0.0
dhclient 829 root DEL REG 259,1 2125 /lib/x86_64-linux-gnu/libdns-export.so.162.1.3
dhclient 829 root mem REG 259,1 162632 1978 /lib/x86_64-linux-gnu/ld-2.23.so
dhclient 829 root 0u CHR 1,3 0t0 6 /dev/null
dhclient 829 root 1u CHR 1,3 0t0 6 /dev/null
dhclient 829 root 2u CHR 1,3 0t0 6 /dev/null
dhclient 829 root 3u unix 0xffff880036debc00 0t0 12925 type=DGRAM
dhclient 829 root 5u pack 12942 0t0 ALL type=SOCK_RAW
dhclient 829 root 6u IPv4 12943 0t0 UDP *:bootpc
Out of 200 servers this is the only one running this process.
I enter the /var/tmp/cloud-init dir and its empty of course and I don't see this executable even in there.
Any insight on what it is and where it may be configured to run at?
Thanks!