View source for Process names I've looked up sometime (some because they were using 100% CPU)

{{#addbodyclass:tag_tech}}

=Things taking unreasonable CPU=
Things that don't do something useful but eat up your processing power endlessly.



==Antimalware==

This often means something is doing a lot of file reading, which ''necessarily'' should be scanned.
This will e.g. make startup after login a little slower than not doing so, but since startup apps are a ''great'' vector for resident malware, that's a check you probably want.


If this lasts for maybe 15 minutes or loneer, this may well be window's file indexing updating (Resource Manageer). 
This can mean a noticeable slowdown in use. Though should only happens occasionally.



<!--
==initctl emit plymouth-ready (Ubuntu)==


The stack trace may (or may not) be handy to see/save:
 sudo cat /proc/$(pidof initctl)/stack

Then you can kill it:
 sudo kill -s ABRT $(pidof initctl)
...which shouldpresent [[apport]] 


Most likely via upstart, specifically /etc/init/plymouth-ready.conf
but why?

-->

==kipmi0 (linux)==
{{stub}}

Short version:
* this process is a background helper that isn't necessary, but speeds up certain IPMI operations
:: non-interrupt IPMI takes a lot of polling
:: if not actively using IPMI, high CPU on this process may be due to an unresponsive BMC
:: This kernel process is essentially high niceness, so it shouldn't steal processing power from anything.


If you're not using IPMI, or are but only rarely, you can disable it by not loading the kernel module.
Edit modprobe.conf to say:
 options ipmi_si force_kipmid=0


You can also make it less insistent, via something like:
 echo 100 > /sys/module/ipmi_si/parameters/kipmid_max_busy_us
(...or in its config)


https://www.novell.com/support/kb/doc.php?id=7003352

http://www-01.ibm.com/support/docview.wss?uid=nas7d580df3d15874988862575fa0050f604

http://mintojoseph.blogspot.nl/2010/05/what-is-kipmi-why-is-it-taking-too-much.html

==ksoftirqd (linux)==
<!--

ksoftirqd gets work when interrupts come in so fast that they cannot be handled 


software interrupts are basically queries towards devices,
and there is one ksoftirqd per CPU that handles these.

Seeing it use 100% CPU is often 
* a misbehaving driver, or it talking to misbehaving hardware.
* an inefficient driver, e.g. network via polling {{verify}}
* something better offloaded, e.g. very-high-bandwidth networking


You can usually find out what driver/device it is by watching /proc/interrupts for things that generate a lot of interrupts (note: for some things, like networking, 1000-2000 interrupts per second is not crazy).


-->
<!--


hardware interrupts are electronic lines raised by devices that want attention ''now'', and is handled by a driver in kernel space.
It's called an interrupt because it tells the CPU to stop what it's doing, store its state to later return to it, and run this driver('s interrupt handler).

software interrupts are processes telling the kernel they want attention paid very soon, and the kernel will often hand it off to a driver. Whether it means talking to the device right then (e.g. syscalls that query devices{{verify}}) or sometime later (e.g. disk ''writes'', due to the io scheduler inbetween) depends on this driver.
Software interrupts can also only come from currently running process, so don't interrupt the CPU scheduling-wise (though still do so program-flow-wise).


Various syscalls will lead to soft soft interrupts.

http://unix.stackexchange.com/questions/17998/what-are-software-and-hardware-interrupts-and-how-are-they-processed
-->

==Google drive (Windows)==
Known bug. Haven't seen it in a while, so possibly resolved in an update?


==mysqld_safe==

See [[MySQL_notes#mysqld_safe_taking_.7E100.25_CPU]]


==Windows explorer (WinXP, mostly)==

Explorer didn't always deal well with previews of certain files.

e.g winXP was would occasionally do the 100% CPU think trying to generate thumbnails for some video files.

See [[Media_thumbnails_and_previews#Windows_-_Video_and_audio_explorer_extensions_.28previews.2C_metadata.29]]

=Other notes on background processes=

For those that are trying to figure out whether there are any running processes that shouldn't be there.


==Linux==

===kworker===
kernel worker threads for various work (most things that take serious time), including 
* interrupts
* timers
* IO

If it's taking a lot of CPU, that often means significant disk IO and/or significant networking.
Sometimes things like sorta-broken drivers.


===jbd2===

[https://en.wikipedia.org/wiki/Journaling_block_device Journaling Block Device] is a journaling layer between the filesystem and storage.

While any filesystem can use it, from what you'll find used it's mainly used by ext4 (called jbd2)

===dsl_scan_iss===

[[ZFS]] scrub.   

Shouldn't be taking 100% CPU, but will often take moderate amounts of IO. 

Shouldn't interfere in that it should back off when you actually use the filesystem, but if you think it's bothering everyday work, remember you can put a limit on how easily it backs off (which on slight use ~= how fast scrubs read).

==Windows==
Common background processes:

Note that this list cannot tell you whether a process is spyware or such, since spyware may choose to name processes one of the below. Install a spyware scanner to discover this.



===system stuff===
* svchost.exe: (usually several) hosts a service (those that need this type of hosting) {{comment|(You can't easily tell which of these processes hosts which service)}}
* services.exe: assists service starts/stops
* rundll32.exe


* alg.exe (mainly handles windows firewall and connection sharing)
* csrss.exe (graphics processing proxy)
* smss.exe (manages login sessions)
* lsass.exe (local security, login. Perhaps see [[lsass.exe taking all cpu]])
* spoolsv.exe (handles printing)
* HelpSvc.exe (Help service. Perhaps see [[HelpSvc.exe taking all cpu]])
* mmc.exe (supports elements of device manager, etc.)


* mdm.exe (process debugging, used e.g. in IE script debugging)


===installed apps===
Microsoft:
* ctfmon.exe (alternate input methods for MS office)
* wdfmgr.exe (part of Windows Media Player 10)

nVidia (video card drivers/utilities):
* nvsvc32.exe

ATI (video card drivers/utilities):
* ati2evxx.exe
* mom.exe
* CCC.exe

Novell: 
* naldesk.exe	
* nalntsrv.exe
* nalrstrt.exe (NAL Restart Utility?)
* zentray.exe
* ZenRem32.exe (Remote Management)
* dpmw32.exe (print, security)	
* nwtray.exe (tray menu)
* nwquota.exe (quota checker & tray menu)
* wm.exe (Workstation Manager)
* wmrundll.exe
* iprntlgn.exe (iPrint)
* iprntctl.exe (iPrint)
* xtagent.exe (NetIdentity)

Apple
* mDNSResponder.exe (Bonjour for Windows, used by iTunes music sharing, and some other apps. See also [[zeroconf]])
* iTunesHelper.exe
* iPodService.exe

Symantec/Norton AntiVirus/Internet Security:
* ccApp.exe (autoprotect and such)
* ccEvtMgr.exe (logger)
* VPtray.exe (tray icon)
* DefWatch.exe (updates virus definitions)
* SavRoam.exe (roaming user support)
* ccSetMgr.exe
* spbbcsvc.exe

Spybot S&D
* TeaTimer.exe (resident protection<!--, local-->) 
* SDHelper.exe (resident protection, browser)

GEAR
* gearsec.exe: Usually seen because some application {{comment|(such as iTunes, Drive Image, Norton Ghost, MixMeister, Cakewalk, others)}} embeds the GEAR CD recording engine. See also http://www.gearsoftware.com/wiki/index.php?title=Gearsec  

Google:
* googletalk.exe: Google talk app
* GoogleUpdateService.exe

VMWare:
* vmware-authd.exe
* vmnat.exe

Installshield:
* ikernel.exe (installation engine, while some installation is open)

Adobe
* apdproxy.exe (camera photo download helper, lightroom)

Wacom
* Tablet.exe
* tabuserw.exe

S3:
* s3hotkey.exe: utility for S3 Twister integrated graphics card (laptops, miniITX systems, etc.), apparently used to switch between monitors, whatever that means exactly.

Sun:
* jusched.exe (java update scheduler/checker)
* jucheck.exe (same)

<!--
IDrive (online backup; see [http://www.idrive.com/])
* IDriveWebM.exe
* IDriveE Service.exe
-->

Realtek:
* RTLCPL.exe (installed with motherboard sound cards)
* soundman.exe (installed with motherboard sound cards)

Pinnacle:
* remoterm.exe (the app that handles the remote for various Pinnacle video products)

InterVideo:
* WinCinemaMgr.exe (part of WinDVD)

AOL (Viewpoint Media Player or Viewpoint Toolbar, used by AIM, AOL, but not really necessary. See also [http://www.pchell.com/support/viewpoint.shtml]):
* viewpointservice.exe
* viewmgr.exe


Other/unsorted:
* starwindservice.exe (Alcohol 120%)

* hasplmv.exe - [https://sentineldongle.com/aladdin-hasp-4-hardlock-srm-hl/ dongle emulator]

* MsMpEng.exe - Windows Defender
* SenseNdr.exe - Windows Defender

* RdrCEF.exe - Acrobat Reader
<!--
* wmiprvse.exe - WBEM[https://en.wikipedia.org/wiki/Web-Based_Enterprise_Management]
-->
* auditbeat.exe - auditing (using [[elasticsearch]]) [https://www.elastic.co/downloads/beats/auditbeat]
<!--

-->


===Unsorted===

WavesLocalServer - DAW related  (which?)




===See also===
* http://www.processlibrary.com/directory/ (explains many services, searchable by executable name. There are various other sites like these; you can often search google for the process name)

* The [http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx autoruns] app, which gives a brief description of the things registered to start with windows


<!--
http://www.hijackthis.de/
-->

[[Category:Technical notes]]