Why is Java consuming 100% CPU on my machine?

Question

I have an iMac (early 2010) running 10.7.2 but the problem has been seen on 10.6.x also. The symptom is simple, one of my 2 cores is sitting at 100% utilization with the Java process responsible for the excessive usage.

What have I done to troubleshoot?

• Reboot - The java process simply restarts and the same condition is seen.
• Kill the Java process - As with a reboot.
• Uninstall and reinstall Java - Soon after installing Java the CPU is back at 100%.

• Using ps "process id" I can see that it is launchd spawning the process and that the command used to start the process is:

  java -Djava.awt.headless=true -jar /tmp/ics29586
  

• The ics29586 file is an 11mb binary file.

• Deleted the ics29586 file - File is recreated at next process restart and same condition is seen
• Created a new user account, rebooted and logged in as the new user - Same condition is seen.
• Played with Java settings and restarted the process after each change - Same condition seen.
• Complete machine rebuild - Soon after installing Java the CPU is back at 100%.

So, has anyone either got the the answer for what is causing it and how to fix it, or some advice on ways of further troubleshooting the issue?

---

In response to some of the comments asking for more info:

• I'm not running crashplan.

• I couldn't work out how to get Activity Monitor to show me open files, but googling suggested LSOF was a good match for what you wanted to know. It showed no open files:

  Deep-Desk:LaunchAgents photo$ sudo lsof -c java
  Deep-Desk:LaunchAgents photo$ 
  

• There are 220 ports open for the Java process at present

• The only file of interest in either the LaunchDaemons or LaunchAgents folders is:

  -rw-r--r--   1 root  wheel   568B 10 Mar  2011 com.microsoft.office.licensing.helper.plist     
  

• Everything else is either com.apple or has a date well after the problem first manifested. By way of a test I have renamed the com.microsoft file to old.com.microsoft but it made no difference. I also moved the file completely out the LaunchDaemons directory and that made no difference either, the process still respawns, hangs around not doing much for a few minutes, then goes out of control and consumes all the CPU on 1 core.

Answer 1

I don't know either, but here's how to find out more

In cases of entirely unknown binaries, strings(1) is often helpful in getting a hint about what the file might be

strings /tmp/ics29586 | less

Have a look through the output and see if it's anything familiar.

Failing that, find out which launchd job it is being launched from:

launchctl list|awk '{id=$3; print "### " id; system("launchctl list " id)}'|awk '/^###/ {id=$2} /.*ics29586.*/ {print id}'

This should output one or more job tags in the form of (for example) com.apple.scrod (and a few errors, which you can ignore).

Once you have the job tag(s), get the launchd config for a job by running:

launchctl list com.apple.scrod    # insert your tag instead

This (and the tag itself, which often contains an internet domain name in reverse notation) should give you some more information about what this process is. Feel free to post it here if you need further help.

Update: Forgot to mention this, but since it's a jar file, you can copy it somewhere and unzip it (jar files are really just zip files) and have a look at what sort of Java classes are in there.

Answer 2

Got it. After help from two friends, I can say the following.

• in /etc/crontab there was an entry:

  */5 * * * * root /usr/bin/adjkerntz
  

  -in /usr/bin there was a program called adjkerntz. I believe that this a genuine name for a valid binary in some unix/linux implementations, but not OSX. It also has different permissions to every other executable in /us/bin:

  -rwxr-xr-x    1 root   wheel     74688 18 Sep 00:26 addftinfo
  -rwx------    1 root   wheel   2841604 18 Sep 20:49 adjkerntz
  -rwxr-xr-x    1 root   wheel    223312 18 Sep 00:26 afconvert
  

• I hashed out the cron entry and killed the java process and hey presto no further issues.

• I also deleted adjkerntz and on the suggestion of my excellent friends, I did the following to make sure it doesn't reoccur:

  sh-3.2# touch adjkerntz
  sh-3.2# chflags schg adjkerntz
  

• This makes the file immutable and even root can't modify that file.

This does leave the question of how this got there in the first place, but I guess the Internet can be a dangerous place. Thanks to all who have contributed their time to helping me get to the bottom of this.

Answer 3

If you drop into terminal, you can type ps -ef | grep java

You'll see all the processes with "java" in their descriptions and details on the process which launched each of them.

In my case, CrashPlan is doing a restore and the client app is Java-based. I see:

0    85     1   0 10:35PM ??        98:28.26 /usr/bin/java -Dapp=**CrashPlanService** -Xmn10m -Xms15m -Xmx512m -DappBaseName=**CrashPlan** -Djava.awt.headless=true -...

Once you know who is using it, you can decide if it's something you want to remove or not...