Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have an iMac (early 2010) running 10.7.2 but the problem has been seen on 10.6.x also. The symptom is simple, one of my 2 cores is sitting at 100% utilization with the Java process responsible for the excessive usage.

What have I done to troubleshoot?

  • Reboot - The java process simply restarts and the same condition is seen.
  • Kill the Java process - As with a reboot.
  • Uninstall and reinstall Java - Soon after installing Java the CPU is back at 100%.
  • Using ps "process id" I can see that it is launchd spawning the process and that the command used to start the process is:

    java -Djava.awt.headless=true -jar /tmp/ics29586
    
  • The ics29586 file is an 11mb binary file.

  • Deleted the ics29586 file - File is recreated at next process restart and same condition is seen
  • Created a new user account, rebooted and logged in as the new user - Same condition is seen.
  • Played with Java settings and restarted the process after each change - Same condition seen.
  • Complete machine rebuild - Soon after installing Java the CPU is back at 100%.

So, has anyone either got the the answer for what is causing it and how to fix it, or some advice on ways of further troubleshooting the issue?


In response to some of the comments asking for more info:

  • I'm not running crashplan.
  • I couldn't work out how to get Activity Monitor to show me open files, but googling suggested LSOF was a good match for what you wanted to know. It showed no open files:

    Deep-Desk:LaunchAgents photo$ sudo lsof -c java
    Deep-Desk:LaunchAgents photo$ 
    
  • There are 220 ports open for the Java process at present

  • The only file of interest in either the LaunchDaemons or LaunchAgents folders is:

    -rw-r--r--   1 root  wheel   568B 10 Mar  2011 com.microsoft.office.licensing.helper.plist     
    
  • Everything else is either com.apple or has a date well after the problem first manifested. By way of a test I have renamed the com.microsoft file to old.com.microsoft but it made no difference. I also moved the file completely out the LaunchDaemons directory and that made no difference either, the process still respawns, hangs around not doing much for a few minutes, then goes out of control and consumes all the CPU on 1 core.

share|improve this question
1  
What open files does the java process have? In the Activity Monitor, click the process, choose "inspect", and look at "Open Files and Ports". Edit that into your question, it will help us know what the process is actually doing. –  Josh Jan 6 '12 at 15:04
1  
What are the contents of the system-wide LaunchAgents/LaunchDaemons folders? Anything whose name doesn't start with com.apple and has e.g. a modification date different from all others? –  Daniel Beck Jan 6 '12 at 15:18
1  
Are you using CrashPlan? Some users reported trouble with it in a topic on another site –  Daniel Beck Jan 6 '12 at 15:22
    
Did you restart the system after moving away the com.microsoft.office.licensing.helper.plist file? What happens when you run launchctl unload -w com.microsoft.office.licensing.helper? –  Daniel Beck Jan 7 '12 at 12:36
    
I didn't but have now to no affect. –  Slyinthefield Jan 7 '12 at 13:22

3 Answers 3

I don't know either, but here's how to find out more

In cases of entirely unknown binaries, strings(1) is often helpful in getting a hint about what the file might be

strings /tmp/ics29586 | less

Have a look through the output and see if it's anything familiar.

Failing that, find out which launchd job it is being launched from:

launchctl list|awk '{id=$3; print "### " id; system("launchctl list " id)}'|awk '/^###/ {id=$2} /.*ics29586.*/ {print id}'

This should output one or more job tags in the form of (for example) com.apple.scrod (and a few errors, which you can ignore).

Once you have the job tag(s), get the launchd config for a job by running:

launchctl list com.apple.scrod    # insert your tag instead

This (and the tag itself, which often contains an internet domain name in reverse notation) should give you some more information about what this process is. Feel free to post it here if you need further help.

Update: Forgot to mention this, but since it's a jar file, you can copy it somewhere and unzip it (jar files are really just zip files) and have a look at what sort of Java classes are in there.

share|improve this answer
1  
+1 -> Had the same issue. Personally I ended up removing Java and use it only in Parallel on an XP VM... I never seem to need Java on Lion, anyway, so why leave it installed? –  Martin S. Stoller Jan 6 '12 at 19:51
    
The strings output showed a whole heap of info, a sample of which is here: org/apache/commons/io/output/ByteArrayOutputStream.class org/lwjgl/NondirectBufferWrapper.class org/xbill/DNS/GPOSRecord.class net/freehaven/tor/control/TorControlConnection$ReplyLine.class org/mozilla/classfile/ClassFileWriter.class org/mozilla/javascript/Script.class; org/bouncycastle/asn1/BERFactory.class redstone/xmlrpc/serializers/json/IntrospectingSerializer.class org/codehaus/jackson/map/JsonMappingException.class org/joda/time/chrono/ISOChronology$Stub.class –  Slyinthefield Jan 7 '12 at 9:52
    
Also the attempt to find the job launching the process was unsuccessful: Deep-Desk:LaunchAgents photo$ launchctl list|awk '{id=$3; print "### " id; system("launchctl list " id)}'|awk '/^###/ {id=$2} /.*ics29586.*/ {print id}' launchctl list returned unknown response launchctl list returned unknown response launchctl list returned unknown response Deep-Desk:LaunchAgents photo$ –  Slyinthefield Jan 7 '12 at 9:56
    
So I also unzipped the JAR as you suggested and can see some the file structure. There is a bit coin miner in there called DiabloMiner.cl and something called klog which worries me –  Slyinthefield Jan 7 '12 at 18:04

If you drop into terminal, you can type ps -ef | grep java

You'll see all the processes with "java" in their descriptions and details on the process which launched each of them.

In my case, CrashPlan is doing a restore and the client app is Java-based. I see:

0    85     1   0 10:35PM ??        98:28.26 /usr/bin/java -Dapp=**CrashPlanService** -Xmn10m -Xms15m -Xmx512m -DappBaseName=**CrashPlan** -Djava.awt.headless=true -...

Once you know who is using it, you can decide if it's something you want to remove or not...

share|improve this answer
up vote 2 down vote accepted

Got it. After help from two friends, I can say the following.

  • in /etc/crontab there was an entry:

    */5 * * * * root /usr/bin/adjkerntz
    

    -in /usr/bin there was a program called adjkerntz. I believe that this a genuine name for a valid binary in some unix/linux implementations, but not OSX. It also has different permissions to every other executable in /us/bin:

    -rwxr-xr-x    1 root   wheel     74688 18 Sep 00:26 addftinfo
    -rwx------    1 root   wheel   2841604 18 Sep 20:49 adjkerntz
    -rwxr-xr-x    1 root   wheel    223312 18 Sep 00:26 afconvert
    
  • I hashed out the cron entry and killed the java process and hey presto no further issues.

  • I also deleted adjkerntz and on the suggestion of my excellent friends, I did the following to make sure it doesn't reoccur:

    sh-3.2# touch adjkerntz
    sh-3.2# chflags schg adjkerntz
    
  • This makes the file immutable and even root can't modify that file.

This does leave the question of how this got there in the first place, but I guess the Internet can be a dangerous place. Thanks to all who have contributed their time to helping me get to the bottom of this.

share|improve this answer
1  
    
I haven't installed the software specified but I am by no means innocent of such things. Karma's a bitch aint it. –  Slyinthefield Jan 8 '12 at 0:36
1  
Ouch :) Poor implementation though, if it was only using one core ;-) –  Ingmar Hupp Jan 8 '12 at 2:52
    
@ingmar HaHa ;) –  Slyinthefield Jan 8 '12 at 8:31
    
Thanks for documenting this program and what it's doing / how to track it. Most people are keeping java off their systems, but with legitimate tools like CrashPlan using it, some choose to still be open to running code from the internet. –  bmike Dec 28 '12 at 16:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.