Swi5: + takes 99% of cpu on build "Tue Jun 28 14:28:07 EDT 2011" x86

[mdima]

Hello,
after the last update to that build (the last one before "snort being unavailable") I found out that the process swi5: + takes 98% of CPU… before that upgrade the processor was really low... what I see is that there are about 6000 processes running, and this process at almost 100%...

Do you have any information about it?

Thanks,
Michele

[jimp]

That's a software interrupt, so that being so high usually means that some bit of hardware is seeing a lot of traffic/activity/etc. Check dmesg, vmstat -i, ps uxawww, etc, in order to see what is really on swi5.

[mdima]

@jimp:

That's a software interrupt, so that being so high usually means that some bit of hardware is seeing a lot of traffic/activity/etc. Check dmesg, vmstat -i, ps uxawww, etc, in order to see what is really on swi5.

Thank you Jim… next time I will see something abnormal on the cpus I will run that commands to see what's going on... even if I think was a guy sending thousands of udp voip registrations (unsuccessful because after a while I closed the port for the public network, but he continued quite a lot, I got full of snort alerts/bans about that)... was really huge as brutal force attack...

Thanks,
Michele