Widely Varying CPU Speed at Idle (20.04)

JohnW · 23 October 2021 02:56

I have the CPU Frequency Scaling Monitor in my Panel, and lately it varies wildly even when the computer is at idle and offline. It seems to coincide with the occasional blink of a light on the PC's front panel (disk activity light I assume). The value for CPU0 briefly jumps from the low 20% range to 97% at times, or to other brief readings in the 60s, 70s or 80s. CPU1-5 jump too, but usually not as high. Not every jump coincides with a blink, but often they're just before or after one. My worry of course is that there's ransomware encrypting my HDD.

When I launch System Monitor from my Panel right now in the Processes tab and pause from typing, it doesn't show anything that coincides with the jumps, with nothing spiking above 4% CPU. The only apps with noticeable frequent activity are mate-system-monitor (0-4%), and lightdm/xorg (0-4% usually less), and it's rare to see anything else rise above 0%. A few others will occasionally flash quickly from Sleeping to Running but those don't seem to coincide with CPU jumps either. The apps Resources tab shows frequent jumps to 20% on most cores but seldom more than one at a time. None of the cores rose above 38% in the minutes I watched. Maybe when several cores rise above their resting >10% level it triggers the CPU speed high anticipating a load? Memory & Swap History
is a flat line at 19%.

System: Dell desktop - Release 20.04.3 LTS (Focal Fossa) 64-bit - Kernel Linux 5.4.0-89-generic x86_64 - Kernel Linux 5.4.0-89-generic x86_64 - 11.5 GiB - Intel® Core™ i5-9400 CPU @ 2.90GHz×6 - Mesa Intel® UHD Graphics 630 (CFL GT2) - Available disk space: 1.1 TB (128GB nvme and two 5TB Seagate ST5000L HDDs, one removed from the USB3 case and on the internal SATA the other on a USB3 port).

Usually there are some processes with negative Nice numbers at -20 or Very High Priority. Right now there's only PulseAudio -10 and VeryHigh Priority. Hopefully that doesn't mean it's done encrypting and I'll soon get an ugly email.

Anyway, is this normal and if not - any ideas/suggestions?

gordon · 26 October 2021 23:28

Before I start my tirade, let me just say this:

TL;DR: Though there's no warranty along with this advice I'm about to give, I will say that I find it unlikely that you have malware installed.

For the record, PulseAudio is supposed to run with a seemingly insanely high priority -- that way, when system scheduling slows down (e.g. when the system starts swapping), your audio doesn't get choppy! (This assumption does not really hold water, BTW, since if the application playing or recording audio has a normal priority, and the application doesn't buffer with PulseAudio very much, then this is pretty much pointless...)

If there aren't other processes with low nicenesses or high priorities, go to the View menu in the System Monitor and make sure All Processes is checked. My Debian Buster system shows a great number of these high-priority "processes", and I guarantee that Ubuntu MATE has way, waaaay more of such processes than my Debian system. (Many of the "processes" listed here are actually kernel threads; my Debian system has a custom, slimmed-down kernel and thus has an unusually low number of kernel threads. On Ubuntu, you'd find other kernel threads like md for handling RAID arrays and such, and it would have the flag of Moldova as its icon. Don't worry, that's a known bug and not ransomware, as I explained in this other curious article.)

Do these flashing lights and subsequent CPU frequency adjustments only occur if one particular application is open? Not to pick on Web browsers too much, but in particular, I've seen cases where multi-process Web browsers like Firefox and Chromium will run untold, but very quick, background jobs in one process or another. The CPU usage shown for each process is usually zero or close to zero (even when the processes are doing something in the background), but when, say, 3 processes do something at once, the result can be a fairly substantial CPU spike that can trigger CPU frequency scaling. Try closing your browser and see if the frequency spikes keep occurring; I know that Mozilla pushes very quiet updates to Firefox to us much more often than we'd like them, and sometimes a bloated and overcomplicated program is all it takes to make things look like malware. You never know.

Similarly, it might be a Web page you have open. If closing down your browser eliminates the spikes, try re-opening the browser and see if the spikes still don't come back. I've seen plenty of cases of that, too.

The rest of this post looks at things from a very pessimistic, paranoid perspective, and you should only consider heeding this advice if you are truly concerned about malware on your system.

Also, a 200+ MB browser (literally) would be a really, really good place to hide malware. You could hide untold amounts of malicious code in there and nobody would notice even if you bloated the browser by 20 MB. If the spikes go away after you close down Firefox for awhile, and you're really concerned about malware, here's my three suggestions:

Back up your important data, if you haven't already.
Back up your important data soon. Putting a backup off for a day to have your data corrupted the following day before you have made your backup is pointless. In other words, don't put it off.
Once you've done the above, you can try purging Firefox (if that's your browser of choice) and reinstalling it with:

sudo apt-get purge firefox
sudo apt-get install firefox

You can purge your Firefox profile too if you want ( WARNING: You will lose your Firefox preferences and probably your saved logins and passwords too!):

rm -r ~/.mozilla/firefox

JohnW · 28 October 2021 01:06

Hey, tirades are most welcome because they clear the air and help me get a read on all these complex interwoven topics. My mind turned to mush after foresaking my intermittent dabblings in *nix while working mostly in windoze, finally bailing at about XP in favor of MacOSX mangled nix.

AH! It used to be, and I stopped checking so somewhere along the way it reverted to "my" and hid what I'd been looking for.

Guess this could explain some of the freaky intermittent problems I've been having with many apps (e.g. VLC that had seemed stable before UbuMate). Any experience or opinions on Debian Mate? I like the interface, and have my wife struggling with UbuMate so a switch might actually be an improvement for her too.

Perhaps unrelated, but the md daemon in MacOSX used to give me fits but maybe that was their inexorable Spotlight thrashing all the time and bogging down our antique MacBooks (and spewing dotfiles onto any removable drive while making us wait to eject them after some quick file copy).

Not when looking at only my processes, so some time with "all" showing may shed some light. It does the freak show even with all apps closed (tho I notice many only seem to close but not "quit" so maybe just stay in RAM but w/o active processes?). Frankly I'm tempted to pop DebMate onto a removable drive and spend time checking that out, rather than more struggle with Ubu quirks. Would you recommend against that for a semi-literate like me, obviously in peril of being completely at sea in these leaky old MacBooks? I could try DebMate on the cheapo new Costco Dell, but want to have the same setup on all 3 computers (and maybe the rPi4 that choked on early UbuM). MacBooks can run UbuM and it roars on the Dell, so...

I'd pondered that, but had been hoping FF is "secure" enough with careful browsing, some limitations, 3 extensions (https everywhere, privacy badger, ublock origin), and Clear All on exit plus Clear History during long sessions. Again, I'm trying to find a compromise for all the computers and my wife to run the same setup and FF is easy & familiar.

I have Timeshift saving system & data on daily, weekly & monthly to the USB3 5TB in the hope that if things go South one of the older versions might be salvageable.

Hey, THANK YOU for taking the time to share your expertise and opinions with a relative newbie. My main consolation in asking stupid questions is the hope that the answers may be useful for others as they have been to me.

I also appreciate the WARNING: notes, even though I'm of course reckless enough to sometimes blunder heedlessly into a sound *nix thrashing.

gordon · 29 October 2021 01:05

Well, besides the places where you took what I said out of context, I think you understood well enough. Just note that, if closing Firefox doesn't get rid of the problem, then probably purging Firefox profile data and the like won't do anything to help with the issue. The purging was only for if Firefox was the culprit.

Also, what I said was that I specially compiled a slim Debian kernel with few kernel threads -- compiling a kernel requires a bit more technical knowledge than I'd like to share right this minute. However, Debian (at least the way I installed it) does allow you to customize parts of the system more than Ubuntu does. I find the Debian MATE experience to be quite pleasing, but don't expect a lot of eye candy or extra functionality -- you have to pick and choose exactly the stuff you want, at least if you install Debian using the "net installer" like I did.

If you want to know more about installing Debian like I did, take a look at Debian -- Network install from a minimal CD.

I don't have any real problems with Debian. The 64-bit version is basically like Ubuntu MATE these days, but with no Ubuntu branding and older packages. The 32-bit version has a few architecture-specific bugs.

JohnW · 29 October 2021 18:19

Oops.

Uh, yeah. This much I did know.

This is helpful and encouraging news. Thanks for the minimal install link too.

Happily, the System Monitor says these old MacBooks are 64 bit. "Intel® Core™2 Duo CPU P8600 @ 2.40GHz × 2"

I'd hoped that the Ubu branding might make things simpler for my wife, but that doesn't seem to be the case given endless hassles with the old packages. Tbird in particular has been nightmarish to get running, and still has niggling glitches. I'm not a big fan of outdated snap app versions.

Thanks for the nudge to try out DebMate. Your kindness in responding is helpful in moving forward.