Search code examples
linuxcentosmcafee

CentOS: Why is the 'cma' process taking so much RAM?


I was checking my server resource usage and noticed that the "cma" process is using a lot of RAM.

top - 15:04:54 up 127 days, 21:00,  1 user,  load average: 0.27, 0.33, 0.24
Tasks: 157 total,   1 running, 156 sleeping,   0 stopped,   0 zombie
Cpu(s):  6.9%us,  0.3%sy,  0.0%ni, 92.6%id,  0.1%wa,  0.0%hi,  0.1%si,  0.0%st
Mem:   4043700k total,  4006616k used,    37084k free,   146968k buffers
Swap:  1052248k total,  1052240k used,        8k free,  1351364k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND           
 4308 root      16   0 2080m 977m 4708 S  0.0 24.8   0:00.02 cma                 
 4396 root      15   0 2080m 977m 4708 S  0.0 24.8   0:00.10 cma                 
 4397 root      16   0 2080m 977m 4708 S  0.0 24.8   3:47.36 cma                 
 4398 root      15   0 2080m 977m 4708 S  0.0 24.8   2:31.40 cma                
 4399 root      15   0 2080m 977m 4708 S  0.0 24.8   0:00.34 cma                 
 4400 root      18   0 2080m 977m 4708 S  0.0 24.8   0:00.00 cma                 
 4403 root      15   0 2080m 977m 4708 S  0.0 24.8   0:47.36 cma                 
 4404 root      18   0 2080m 977m 4708 S  0.0 24.8   0:00.07 cma                 
 4405 root      18   0 2080m 977m 4708 S  0.0 24.8   0:00.04 cma                 
 4406 root      15   0 2080m 977m 4708 S  0.0 24.8   0:12.14 cma                 
 4408 root      19   0 2080m 977m 4708 S  0.0 24.8   0:00.00 cma       

I found this forum post from last year and apparently these processes have to do with McAfee virus scanning.

I ran pmap on one of the processes and this is the last line of output:

mapped: 2130892K    writeable/private: 2113632K    shared: 40K

Is this process really using 2.1GB of memory? Is Top reporting the memory usage accurately>

Thanks!


Solution

  • The VIRT column tells you the total size of the virtual memory segments mapped into the process - this includes the executable itself, libraries, data segments, stack, heap, memory mapped files, etc. In a sense, it is the total amount of memory that the process currently has permission to touch in one way or another (read, write, execute). The process is not necessarily using all of that, which is one of several reasons that the RES column reports a smaller number. RES is the total size of the subset of the VIRT size that is actually currently in physical memory at the moment. It is a better (but still not great) measure of how much memory the process is actually using - the fact that it is in memory indicates that it has been or is currently being actively used. However, if your system has lots of memory, a portion of that RES number may have been touched 3 days ago, and not since, so it may not be actively in use. Conversely, if you are short on memory, the process may be trying to actively use more than RES currently indicates, which will result in paging/swapping activity and performance issues.

    Then there's the tendency for some types of memory (executables, libraries) to be shared between multiple instances of a program, the existence of IPC-type shared memory, and several other things that all factor into "how much memory is this process using?"...

    In other words, it's not as simple a question as you might imagine...