On 1/6/25 1:00 PM, Will McDonald wrote:
On Mon, 6 Jan 2025 at 17:50, Jeffrey Walton <noloader@gmail.com mailto:noloader@gmail.com> wrote:
On Mon, Jan 6, 2025 at 12:36 PM Tim Evans <tkevans@tkevans.com <mailto:tkevans@tkevans.com>> wrote: > > Have noticed very heavy sluggishness in my F-41 system response over the > past week or so. Totally idle system showing steady 1.0+ system load > average; lightly used system showing 2.0+. Some apps' response delayed > 30 seconds or longer. > > Top shows tracker-miner-fs-3 steady at 18-35% CPU I would be interested to learn about how the malware got on your system. It sounds like it managed to install itself with root privileges. Do you recall what you were doing around the time it showed up or you experienced the slow down?You might want to slow down before jumping to the 'malware' conclusion.
[wmcdonald@fedora ~ ]$ rpm -qi `rpm -qf /usr/libexec/tracker-miner-fs-3` Name : tracker-miners Version : 3.7.4 Release : 2.fc41 Architecture: x86_64 Install Date: Thu 02 Jan 2025 14:35:31 GMT Group : Unspecified Size : 4559227 License : GPL-2.0-or-later AND LGPL-2.1-or-later Signature : RSA/SHA256, Thu 12 Dec 2024 19:10:53 GMT, Key ID d0622462e99d6ad1 Source RPM : tracker-miners-3.7.4-2.fc41.src.rpm Build Date : Thu 12 Dec 2024 15:47:19 GMT Build Host : buildvm-x86-14.iad2.fedoraproject.org <http://buildvm- x86-14.iad2.fedoraproject.org> Packager : Fedora Project Vendor : Fedora Project URL : https://gnome.pages.gitlab.gnome.org/tracker/ <https:// gnome.pages.gitlab.gnome.org/tracker/> Bug URL : https://bugz.fedoraproject.org/tracker-miners <https:// bugz.fedoraproject.org/tracker-miners> Summary : Tracker miners and metadata extractors Description : Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
Yeah, clearly installed via dnf in some routine update, in my case in mid-December. I see it on two other local systems here, but it's not running continuously on them, just on the one system. Must be a config somewhere, but the man page doesn't mention any configuration files, just some startup and debug options. Wonder if it's crawling across NFS mounts to my NAS?