ioftpd.exe taking 100% cpu

[djrob]

This started a few days ago and now it happens quite randomly (as far as i can se) up to 5 times a day. And that's not on one box only but 4 boxes has this same issue and it's getting really annoying :(
I have heard ideas about scripts causing this and such but i don't know where to start... don't even have much scripts, just iobanana and ioa. If anyone has any ideas what could be causing this or on where to start looking for errors then please let me know :)

[Mouton]

Have u tried site who, and kicking all users one by one (icluding the sitebot) ?

[djrob]

No, but i'll try that. However, it seems to happen even when there's no users at all (except sitebot then) logged in

[FTPServerTools]

Goto www.sysinternals.com and download processexplorer. Start it and find out which part of ioftpd is taking the cpu time. Likely it is a script.

[djrob]

Great suggestion. I'll do it right away, thanks :)

[Mouton]

if processexplorer shows you the problem, please make a screenshot. would make a kb article with it.

ps: please don't use paint on the original screenshot! or at least, keep the unmodified version too! :)

[djrob]

Still not shure exactly what to look for but now it hanged again using 100%cpu and that i can see in both processs explorer and windows own task manager. It doesn't really point me in any direction regarding scripts and tcl as i can understand BUT i do see iobanana.exe running even though there is no activity what so ever on the server so that's kinda strange i guess...

http://medlem.spray.se/djrob01/enny.jpg

[FTPServerTools]

Ok now right click on ioftpd and choose properties. THen you see another window with all the stuff io is using. Look specially at performance, performace graph but also (very important) at the threads. Likely there is one thread eating your cpu. If so try and kill the thread and see what happens. Be aware tho it might crash io so it is just to find out if it is the case. You may be able to find out why so much cpu is taking.
Also you can use filemon to see if io is constantly busy reading writing files (kick everyone out first of course).

[djrob]

Ok, "finally" it hanged again... :rolleyes:
Tried doing like suggested but as usual i'm not really shure on how to do it so i did some screenshots of it :)

http://medlem.spray.se/djrob01/graph.jpg

http://medlem.spray.se/djrob01/threads.jpg


The threads didn't have any names but i tried killing them one by one. After the first nothing happened but after the second it went back to normal. That thread was called thread300... :confused:

[FTPServerTools]

I assume this is the latest ioFTPD version so I'll need some time to find where teh thread is that was hanging. The address is there, I guess darkone has enough info to tell you exactly what is hanging. Since I dont have the source code it is harder for me to say to. Then you killed the second thread the one with ioFTPD.exe+0x325a0 did iobanana get killed as well? If so then it may very well be ioBanana hanging. I had hoped I would seee some more info but alas no luck....

[Mouton]

might be a good idea to check ioFTPD.log and try to find exactly what command was done at 17:30:39... (I think the screenshot u posted is the thread that was causing the problem, yes?) You might have to calculate it in UTC. Not sure if io log timestamps use UTC or localtime.

[djrob]

Not much in logs i'm afraid. This is my private server and not much activity on this one (have the same problem on 2 other more active sites though)

09-17-2004 17:11:58 LOGIN: "FTP_Service" "djrob" "siteops" "tagline... ?"
09-17-2004 17:23:33 LOGIN: "Telnet_Service" "sitebot" "nukers" "Vote djrob for president"
09-17-2004 17:23:43 LOGOUT: "FTP_Service" "djrob" "siteops" "tagline... ?"
09-17-2004 23:08:16 LOGIN: "FTP_Service" "sitebot" "nukers" "Vote djrob for president"
09-17-2004 23:08:17 LOGIN: "FTP_Service" "sitebot" "nukers" "Vote djrob for president"

[Mouton]

xferlog too... to see if a file was finished uploading at that time, or a download...

[djrob]

Checked xferlog now and there were some mp3's beeing uploaded at that time yesterday but as far as i can see (and hear) they are all complete. (They were uploaded by a friend of mine just for fun and had no sfv file even) :p
It hung again this morning and like the last time i had to kill 2 processes to end it. This pic is before killing anything:

http://medlem.spray.se/djrob01/senaste.jpg

[FTPServerTools]

SO if you can find which mp3's it were then reupload those mp3's and see if they cause the 100% if so then you know it is a script that can not handle those mp3's. In such case contact the author of the script with one of the mp3's that goes odd and then it can be solved...