Long rpm root process?

[dmalk]

Hello,

I had my webhost upgrade me to a new VPS last week. Since then, I've been keeping an eye on resource usage, etc, and all's been good.

This morning, however, I strange root process caught my eye in the daily process log as it used 81% CPU and was 33,921 characters long. It begins...

/usr/bin/rpm -V --noscripts MySQL56-client MySQL56-devel MySQL56-server MySQL56-shared MySQL56-test compat-MySQL50-shared compat-MySQL51-shared cpanel-ace-editor cpanel-angular-chosen cpanel-angular-growl-2 cpanel-angular-ui-bootstrap cpanel-angular-ui-bootstrap-devel cpanel-angular-ui-scroll ...

Webhost support told me it was cPanel related and I can ignore it. The massive size of this command, though, still has me wondering.

I'm new to Linux but digging around, I see that this command is a package manager. Perhaps it's verifying all the cPanel packages on the system? I parsed the statement into a long list of 1139 packages that are mostly prefixed with "cpanel-".

I searched around a bit to see if anyone else experienced this but I turned up empty-handed.

Anyway, I'm just wondering if something like this seem out of the ordinary.

Thank you so much!
Damon

 

[cPanelLauren]

Hi Damon,


the rpm command rpm -V is verifying the system packages but shouldn't take an extremely long amount of time to run. Though I don't see the pid listed it should be on the left (if you're looking at top)

Could you run the following:

ps faux |grep <PID>

and paste the output, I'd like to see how long it's been running


Thank you,

 

[dmalk]

Hi Lauren,

Thanks for getting back with me!

I was seeing this massively long command logged in WHM's Daily Process Log and unfortunately, I don't see a pid anywhere. Checking the Process Manager, I don't see this command listed there either so I assume it's finished running.

Is it relatively common for rpm to verify a large number (1139) of system packages?

I believe I have to put in a request with my webhost if I want shell access to dig deeper. I will do this if a large command like this (see attached) seems unusual/suspicious.

Thank you again - I really appreciate your help!

Damon

 

[cPanelLauren]

Hi @dmalk

If you don't see it there currently that's good. If you saw it there in the daily process log under "Top Processes " that doesn't necessarily indicate that the process is running currently just that the process did run that day and it was a top CPU consuming process. An explanation of this can be found in our documentation here:
Daily Process Log - Version 70 Documentation - cPanel Documentation

It would be normal on installation for the system to verify the RPM's and the 1139 you saw was more than likely what occurred during the initial installation.


Thank you,