Sar (if you have it) will help to resolve whether paging is giving you 
an issue (due to the greatly reduced amount of RAM you now have available).
The command 
% sar -B
gives paging stats.
For instance with a 2.6 kernel it is possible to see the pageing stats and an indication
of major faults (those requiring disk access to load a page into RAM). A large
number of 
major page faults per second  could potentially cause poor performance ior indicate 
a program was starting.

Vmstat can also be used to monitor performance stats
% vmstat 10
This'll give stats every 10 seconds providing CPU stats, io, swapping, CPU and system
stats (context switch and interrupts). It may be worth monitoring this during
periods of poor performance to see if something stands out.

Sorry, I can't give any actual figures that may indicate problems, but I hope it helps.

thanks
Mike,


-----Original Message-----
From: linux-aus-admin@lists.linux.org.au [mailto:linux-aus-admin@lists.linux.org.au]
On Behalf Of lug@phormix.com
Sent: Thursday, 2 December 2004 3:44 AM
To: linux-aus@lists.linux.org.au
Subject: Re: [Linux-aus] SaMBa using all available CPU 


I'm probably a bit off on this since you do state that it's the samba daemon in
particular that's sucking CPU, buuuuuut just to give it a shot. Firstly, what Distro
are you using (helps me know what tools are available).

Also, what happens if you kill off samba for a few moment or two, and run some
processes that cause either heavy disk usage or network traffic? I've had some very
funkified things happen with bad cheap NICS (particularly onboard NICS which may be
pulling system resources). The RAM could also perhaps be a factor if you're running
heavily into swapspace for some reason and your HDD is subsequently thrashing with
both hefty simultaneous swapping and DB operations? You could try writing a
temporary 500MB file to see what happens with high hard-disk IO: dd if=/dev/zero
of=/tmp/somefile bs=1k count=500000

Network traffic, perhaps just copying a large file via FTP, http, or some other
means (perhaps SCP although the encryption may mean slower network overhead but more
CPU due to encryption). On Wednesday 01 December 2004 15:07, lug@phormix.com wrote:
> Did you swap to a different architecture?

No, both are Intel Celeries of similar speed. Only hardware differences are
motherboard (one has a built-in via-rhine LAN I/F, the other does
not) and the flaky machine had 1.5GB of RAM, the replacement has only 512kB.

> Kernel optimization another possibility.

Same hard drive == no software changes.

> Also, check that DMA is turned on with the hard drive?

DMA, readhead, all manner of goodness.

If it helps, the CPU useage is split about 50-50 between user and kernel time, and
doing a "refresh" (involves lots of db activity) in the app results in one smbd
using about 60% CPU on a 2.4GHz machine.

Cheers; Leon