CUPS Weirdness - Redhat

This is a discussion on CUPS Weirdness - Redhat ; I am currently running FC3 and things seem to be running fine. However, I was just noticing that in my CUPS access.log there is something (I know not what) that is accessing the CUPS server every 10 seconds. A brief ...

+ Reply to Thread
Results 1 to 5 of 5

Thread: CUPS Weirdness

  1. CUPS Weirdness

    I am currently running FC3 and things seem to be running fine. However, I was
    just noticing that in my CUPS access.log there is something (I know not what)
    that is accessing the CUPS server every 10 seconds. A brief excerpt from
    access.log:

    localhost - - [04/Dec/2005:10:00:22 -0500] "POST / HTTP/1.1" 200 193
    localhost - - [04/Dec/2005:10:00:32 -0500] "POST / HTTP/1.1" 200 272
    localhost - - [04/Dec/2005:10:00:32 -0500] "POST / HTTP/1.1" 200 193
    localhost - - [04/Dec/2005:10:00:42 -0500] "POST / HTTP/1.1" 200 272
    localhost - - [04/Dec/2005:10:00:42 -0500] "POST / HTTP/1.1" 200 193
    localhost - - [04/Dec/2005:10:00:52 -0500] "POST / HTTP/1.1" 200 272
    localhost - - [04/Dec/2005:10:00:52 -0500] "POST / HTTP/1.1" 200 193
    localhost - - [04/Dec/2005:10:01:02 -0500] "POST / HTTP/1.1" 200 272
    localhost - - [04/Dec/2005:10:01:02 -0500] "POST / HTTP/1.1" 200 193

    and so on.

    This is really creating a huge log file and is undoubtedly slowing the system
    (if even only a little). I tried using tcpdump to monitor (locally) all
    activity on porrt 631 and I can see little bursts of activity every 10 seconds:

    10:27:32.618220 IP localhost.ipp > localhost.59815: P 294:311(17) ack 642 win
    8192
    10:27:32.618258 IP localhost.ipp > localhost.59815: P 311:348(37) ack 642 win
    8192
    10:27:32.618273 IP localhost.ipp > localhost.59815: P 348:366(18) ack 642 win
    8192
    10:27:32.660035 IP localhost.59815 > localhost.ipp: . ack 366 win 8192

    10:27:32.660063 IP localhost.ipp > localhost.59815: P 366:3827(3461) ack 642 win
    8192
    10:27:32.660259 IP localhost.59815 > localhost.ipp: . ack 3827 win 12344

    10:27:32.661666 IP localhost.59815 > localhost.ipp: F 642:642(0) ack 3827 win
    12344
    10:27:32.668450 IP localhost.ipp > localhost.59815: F 3827:3827(0) ack 643 win
    8192
    10:27:32.668478 IP localhost.59815 > localhost.ipp: . ack 3828 win 12344

    (and so on)

    The problem is I can't tell which PROCESS is actually speaking to CUPS from this
    (or is it hidden in there somewhere?).

    Any other way to tell which process is causing the commotion so I can figure out
    what it is trying to do and get it to stop?

    P.S. I don't have X running on this server so I need a command line
    solution.....



  2. Re: CUPS Weirdness

    Noone wrote:
    > I am currently running FC3 and things seem to be running fine. However, I was
    > just noticing that in my CUPS access.log there is something (I know not what)
    > that is accessing the CUPS server every 10 seconds. A brief excerpt from
    > access.log:
    >
    > localhost - - [04/Dec/2005:10:00:22 -0500] "POST / HTTP/1.1" 200 193
    > localhost - - [04/Dec/2005:10:00:32 -0500] "POST / HTTP/1.1" 200 272
    > localhost - - [04/Dec/2005:10:00:32 -0500] "POST / HTTP/1.1" 200 193
    > localhost - - [04/Dec/2005:10:00:42 -0500] "POST / HTTP/1.1" 200 272
    > localhost - - [04/Dec/2005:10:00:42 -0500] "POST / HTTP/1.1" 200 193
    > localhost - - [04/Dec/2005:10:00:52 -0500] "POST / HTTP/1.1" 200 272
    > localhost - - [04/Dec/2005:10:00:52 -0500] "POST / HTTP/1.1" 200 193
    > localhost - - [04/Dec/2005:10:01:02 -0500] "POST / HTTP/1.1" 200 272
    > localhost - - [04/Dec/2005:10:01:02 -0500] "POST / HTTP/1.1" 200 193
    >
    > and so on.
    >
    > This is really creating a huge log file and is undoubtedly slowing the system
    > (if even only a little). I tried using tcpdump to monitor (locally) all
    > activity on porrt 631 and I can see little bursts of activity every 10 seconds:
    >
    > 10:27:32.618220 IP localhost.ipp > localhost.59815: P 294:311(17) ack 642 win
    > 8192
    > 10:27:32.618258 IP localhost.ipp > localhost.59815: P 311:348(37) ack 642 win
    > 8192
    > 10:27:32.618273 IP localhost.ipp > localhost.59815: P 348:366(18) ack 642 win
    > 8192
    > 10:27:32.660035 IP localhost.59815 > localhost.ipp: . ack 366 win 8192
    >
    > 10:27:32.660063 IP localhost.ipp > localhost.59815: P 366:3827(3461) ack 642 win
    > 8192
    > 10:27:32.660259 IP localhost.59815 > localhost.ipp: . ack 3827 win 12344
    >
    > 10:27:32.661666 IP localhost.59815 > localhost.ipp: F 642:642(0) ack 3827 win
    > 12344
    > 10:27:32.668450 IP localhost.ipp > localhost.59815: F 3827:3827(0) ack 643 win
    > 8192
    > 10:27:32.668478 IP localhost.59815 > localhost.ipp: . ack 3828 win 12344
    >
    > (and so on)
    >
    > The problem is I can't tell which PROCESS is actually speaking to CUPS from this
    > (or is it hidden in there somewhere?).
    >
    > Any other way to tell which process is causing the commotion so I can figure out
    > what it is trying to do and get it to stop?
    >
    > P.S. I don't have X running on this server so I need a command line
    > solution.....
    >
    >


    The simplest method, of which I assume you have looked at already, is to
    run ps on the localhost
    % ps -aux

    or top

    % top

    Look for any root processes that were left running, or possible cron
    jobs that you started and forgot
    about. Do a man page on top to look to determine what tool/process is
    attemtping to access CUPS.
    If you are still unable to determine the rouge process, I would suggest
    a system reboot to close
    out all processes. Once the system comes back, check the status (again
    using ps or top) to see if the
    offending process is running.

    Good luck.

    Joe

  3. Re: CUPS Weirdness

    On Sun, 04 Dec 2005 09:58:15 +0000, Joe Cipale wrote:

    >Noone wrote:
    >> I am currently running FC3 and things seem to be running fine. However, I was
    >> just noticing that in my CUPS access.log there is something (I know not what)
    >> that is accessing the CUPS server every 10 seconds. A brief excerpt from
    >> access.log:
    >>


    Snipping of lots of log stuff..

    >> Any other way to tell which process is causing the commotion so I can figure out
    >> what it is trying to do and get it to stop?
    >>
    >> P.S. I don't have X running on this server so I need a command line
    >> solution.....
    >>
    >>

    >
    >The simplest method, of which I assume you have looked at already, is to
    >run ps on the localhost
    >% ps -aux
    >
    >or top
    >
    >% top
    >
    >Look for any root processes that were left running, or possible cron
    >jobs that you started and forgot
    >about. Do a man page on top to look to determine what tool/process is
    >attemtping to access CUPS.
    >If you are still unable to determine the rouge process, I would suggest
    >a system reboot to close
    >out all processes. Once the system comes back, check the status (again
    >using ps or top) to see if the
    >offending process is running.
    >
    >Good luck.
    >
    >Joe


    Well, I did try both top and ps. Problem is that, while they show the processes
    neither tells what the processes are actually doing at any given moment (just
    that they are running). I did not see any processes that looked out of the
    ordinary - to my untrained eyes at least - and was why I asked the question.
    So, is there a command that lets you see what ports a process is accessing (not
    just listening)? Perhaps something that shows what processes are actually
    performing I/O or have pipes open?

    In the meantine I did shutdown and reboot and it did stop the problem. I still
    don't know what process was the culprit or why it was doing what it was doing so
    even though it is fixed I am still feeling a bit unsatisfactory about the
    resolution!


  4. Re: CUPS Weirdness

    Noone wrote:
    > On Sun, 04 Dec 2005 09:58:15 +0000, Joe Cipale wrote:
    >
    >
    >>Noone wrote:
    >>
    >>>I am currently running FC3 and things seem to be running fine. However, I was
    >>>just noticing that in my CUPS access.log there is something (I know not what)
    >>>that is accessing the CUPS server every 10 seconds. A brief excerpt from
    >>>access.log:
    >>>

    >
    >
    > Snipping of lots of log stuff..
    >
    >
    >>>Any other way to tell which process is causing the commotion so I can figure out
    >>>what it is trying to do and get it to stop?
    >>>
    >>>P.S. I don't have X running on this server so I need a command line
    >>>solution.....
    >>>
    >>>

    >>
    >>The simplest method, of which I assume you have looked at already, is to
    >>run ps on the localhost
    >>% ps -aux
    >>
    >>or top
    >>
    >>% top
    >>
    >>Look for any root processes that were left running, or possible cron
    >>jobs that you started and forgot
    >>about. Do a man page on top to look to determine what tool/process is
    >>attemtping to access CUPS.
    >>If you are still unable to determine the rouge process, I would suggest
    >>a system reboot to close
    >>out all processes. Once the system comes back, check the status (again
    >>using ps or top) to see if the
    >>offending process is running.
    >>
    >>Good luck.
    >>
    >>Joe

    >
    >
    > Well, I did try both top and ps. Problem is that, while they show the processes
    > neither tells what the processes are actually doing at any given moment (just
    > that they are running). I did not see any processes that looked out of the
    > ordinary - to my untrained eyes at least - and was why I asked the question.
    > So, is there a command that lets you see what ports a process is accessing (not
    > just listening)? Perhaps something that shows what processes are actually
    > performing I/O or have pipes open?
    >
    > In the meantine I did shutdown and reboot and it did stop the problem. I still
    > don't know what process was the culprit or why it was doing what it was doing so
    > even though it is fixed I am still feeling a bit unsatisfactory about the
    > resolution!
    >


    Typically... a process will go into a parent-child spawning mode if the
    parent process
    does not gracefully die. Without knowing what caused the problem, it is
    difficult to trace.
    I would suggest keeping an eye on any printing you do in the futyre and
    see if you can
    trap the culprit.

    GOod luck

    Joe

  5. Re: CUPS Weirdness

    Noone schreef:
    > On Sun, 04 Dec 2005 09:58:15 +0000, Joe Cipale wrote:
    >
    >
    >>Noone wrote:
    >>
    >>>I am currently running FC3 and things seem to be running fine. However, I was
    >>>just noticing that in my CUPS access.log there is something (I know not what)
    >>>that is accessing the CUPS server every 10 seconds. A brief excerpt from
    >>>access.log:
    >>>


    Normally, http://localhost:631 is used to access the cups web interface
    (where you can add, remove, monitor, ... printer queues).
    So I would guess that some print monitoring tool got activated...

    Friendly regards,

    Greg.

+ Reply to Thread