[EdLUG] Desktop weird behaviour

[Edinburgh Linux Users Group]

> Having a squint at my syslog shows;
> /usr/lib/php/sessionclean
> is that something to be concerned about? Also this;
> Jul 17 13:45:01 xubuntu1 CRON[29977]: (root) CMD (command -v debian-sa1 > /dev/
> null && debian-sa1 1 1)

There's a /usr/lib/php/sessionclean in php-common; Google shows me
some LaunchPad bugs talking about how much PHP session-cleaning
cronjobs can stress the system even when there's no good reason for
them to be running in the first place.

The "debian-sa1" thing looks like a sysstat cronjob, which also sounds
like something that might imaginably have been hogging some relatively
subtle resources, but on the other hand if so then you'd think it
would be keeping some sort of log...

Are those packages you've got deliberately installed to do useful
stuff, or could you try just uninstalling them and seeing if the
problem goes away?

> 1) anyone know what the original problem was?

Yes - your desktop went haywire!  Beyond that I'm not sure, but it
sounds as if it might be a problem with disk IO or something (like
maybe these days some kind of exotic dbus contention) rather than just
the CPU.

> 2) are there other ways to tell what's happened?

Check when those cronjobs are due to run again and see if it recurs,
maybe with a "watch ps afwwx" or "iotop" running?

(Personally, I run gkrellm, which makes it easy to see what's going on
if system resources are suddenly in short supply...)

> 3) is there some malware going round matching this description?

If it's alarming you but not detectably achieving anything then it's
not doing a very good job as malware...
-- 
Justin B Rye
http://jbr.me.uk/