Jtdylktuy

I am using the Linux ps command to monitor the RSS size of the processes from inside a Docker container. If the total RSS goes above a threshold, then I fail the tests and start looking for memory regressions.

Here is the entire ps output from inside a Docker container.

 PID %CPU      RSS Threads COMMAND

   1  0.0     2616       1 sh /test/Build/unittest.sh

   7  3.3    44240       1   /usr/bin/Xvfb :1 -screen 0 ...

  17  1.5    10824       1   /usr/bin/fluxbox

 357  690  6292244     324   java -server -Xmx2g ...

 490  0.4     7852       1     /usr/bin/python /usr/bin/dstat ...

 491  0.7     7812       1     /usr/bin/python /usr/bin/dstat ...

1331  0.0     3040       1     /usr/bin/ps -AHww --format ...

1332  0.0      380       1     /usr/bin/ls --all ...

1333  0.0  6292248       1     [NDR-347]

The Java process (pid: 357) creates short-lived child processes. In the above output, you can see 2 dstat Python processes, ps, ls and [NDR-347]". These were all created by the Java process.

Sometimes, I see a duplicate child process (i.e. same command) but different process ID (not shown). Why do I see a duplicate child process? I figure this is some sort of Linux or Docker artifact. What is that artifact?

I have been monitoring ps output for over a year now. For the first time, I see an extra process "[NDR-347]" (pid: 1333) with almost the same RSS. The Java process (pid: 357) names the threads "NDR-#" so I find it strange that the command of a child process would be the name of a thread from the Java process. The extra process doubles the RSS and triggers a problem. The problem is not reproducible. This suggests to me that pid 1333 is very short-lived and is not caught by ps. The total RSS is 12.07 GB and without the extra process it is 6.07 GB. What is this extra process? Why does it have such a huge RSS?

Edit: The exact ps command is...

ps -Ahww --format pid,%cpu,rss:8,nlwp=Threads,command

You have a java process that runs other programs.

Like any other process that wants to run another program, the first step is to fork. This forked process inherits the memory map of the parent. This memory is shared, so it doesn't really use additional RAM.

The next step after fork is to execve the new process. The execve releases all memory and maps the memory from the new program.

Normally the execve follows very soon after the fork, so it is unlikely that you catch a process in this state, but occasionally it will happen.

In your particular case, if you know that the forked Java processes contain the name NDR-, then you should just ignore these processes.