tracker-miner Dragging Down System

[Tim Evans]

Have noticed very heavy sluggishness in my F-41 system response over the 
past week or so.  Totally idle system showing steady 1.0+ system load 
average; lightly used system showing 2.0+. Some apps' response delayed 
30 seconds or longer.

Top shows tracker-miner-fs-3 steady at 18-35% CPU

systemctl status shows:

tkevans@osprey:/home/tkevans$ systemctl status | grep track
                  │ │ │ └─77161 grep track
                  │ ├─tracker-miner-fs-3.service
                  │ │ └─77151 /usr/libexec/tracker-miner-fs-3

But:

tkevans@osprey:/home/tkevans$ systemctl stop tracker-miner-fs-3.service
Failed to stop tracker-miner-fs-3.service: Unit 
tracker-miner-fs-3.service not loaded

I've killed the process for now,  and system load back to normal, but 
wonder why this is happening and how to adjust it.

# uname -a
Linux osprey 6.12.8-200.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jan  2 
19:26:03 UTC 2025 x86_64 GNU/Linux

Standard Gnome desktop.

Thanks.

[Jeffrey Walton]

On Mon, Jan 6, 2025 at 12:36 PM Tim Evans  wrote:
> Have noticed very heavy sluggishness in my F-41 system response over the
> past week or so.  Totally idle system showing steady 1.0+ system load
> average; lightly used system showing 2.0+. Some apps' response delayed
> 30 seconds or longer.
>
> Top shows tracker-miner-fs-3 steady at 18-35% CPU
>
> systemctl status shows:
>
> tkevans@osprey:/home/tkevans$ systemctl status | grep track
>                   │ │ │ └─77161 grep track
>                   │ ├─tracker-miner-fs-3.service
>                   │ │ └─77151 /usr/libexec/tracker-miner-fs-3
>
> But:
>
> tkevans@osprey:/home/tkevans$ systemctl stop tracker-miner-fs-3.service
> Failed to stop tracker-miner-fs-3.service: Unit
> tracker-miner-fs-3.service not loaded
>
> I've killed the process for now,  and system load back to normal, but
> wonder why this is happening and how to adjust it.
>
> # uname -a
> Linux osprey 6.12.8-200.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jan  2
> 19:26:03 UTC 2025 x86_64 GNU/Linux
>
> Standard Gnome desktop.

I would be interested to learn about how the malware got on your
system. It sounds like it managed to install itself with root
privileges.

Do you recall what you were doing around the time it showed up or you
experienced the slow down?

Jeff

[Will McDonald]

On Mon, 6 Jan 2025 at 17:50, Jeffrey Walton  wrote:
> On Mon, Jan 6, 2025 at 12:36 PM Tim Evans  wrote:
> > Have noticed very heavy sluggishness in my F-41 system response over the
> > past week or so.  Totally idle system showing steady 1.0+ system load
> > average; lightly used system showing 2.0+. Some apps' response delayed
> > 30 seconds or longer.
> >
> > Top shows tracker-miner-fs-3 steady at 18-35% CPU
>
> I would be interested to learn about how the malware got on your
> system. It sounds like it managed to install itself with root
> privileges.
>
> Do you recall what you were doing around the time it showed up or you
> experienced the slow down?

You might want to slow down before jumping to the 'malware' conclusion.

My immediate thought was 'oh, that doesn't sound good', too but if you
search for that process name...

https://duckduckgo.com/?t=ffab&q=tracker-miner-fs-3&atb=v443-1&i...

Or check your own system, this looks like it's a completely legitimate
package. Whether it's something you want/need or not is another matter but
we shouldn't jump to conclusions without some base evidence...

[wmcdonald@fedora ~ ]$ ps -ef | grep [t]racker
wmcdona+    3673    2022  0 Jan02 ?        00:00:04
/usr/libexec/tracker-miner-fs-3

[wmcdonald@fedora ~ ]$ rpm -qf /usr/libexec/tracker-miner-fs-3
tracker-miners-3.7.4-2.fc41.x86_64

[wmcdonald@fedora ~ ]$ rpm -qi `rpm -qf /usr/libexec/tracker-miner-fs-3`
Name        : tracker-miners
Version     : 3.7.4
Release     : 2.fc41
Architecture: x86_64
Install Date: Thu 02 Jan 2025 14:35:31 GMT
Group       : Unspecified
Size        : 4559227
License     : GPL-2.0-or-later AND LGPL-2.1-or-later
Signature   : RSA/SHA256, Thu 12 Dec 2024 19:10:53 GMT, Key ID
d0622462e99d6ad1
Source RPM  : tracker-miners-3.7.4-2.fc41.src.rpm
Build Date  : Thu 12 Dec 2024 15:47:19 GMT
Build Host  : buildvm-x86-14.iad2.fedoraproject.org
Packager    : Fedora Project
Vendor      : Fedora Project
URL         : https://gnome.pages.gitlab.gnome.org/tracker/
Bug URL     : https://bugz.fedoraproject.org/tracker-miners
Summary     : Tracker miners and metadata extractors
Description :
Tracker is a powerful desktop-neutral first class object database,
tag/metadata database and search tool.

This package contains various miners and metadata extractors for tracker.

[Jeffrey Walton]

On Mon, Jan 6, 2025 at 1:00 PM Will McDonald  wrote:
> On Mon, 6 Jan 2025 at 17:50, Jeffrey Walton  wrote:
> > On Mon, Jan 6, 2025 at 12:36 PM Tim Evans  wrote:
> > > Have noticed very heavy sluggishness in my F-41 system response over the
> > > past week or so.  Totally idle system showing steady 1.0+ system load
> > > average; lightly used system showing 2.0+. Some apps' response delayed
> > > 30 seconds or longer.
> > >
> > > Top shows tracker-miner-fs-3 steady at 18-35% CPU
> >
> > I would be interested to learn about how the malware got on your
> > system. It sounds like it managed to install itself with root
> > privileges.
> >
> > Do you recall what you were doing around the time it showed up or you
> > experienced the slow down?
>
> You might want to slow down before jumping to the 'malware' conclusion.
>
> My immediate thought was 'oh, that doesn't sound good', too but if you search for that process name...
>
> https://duckduckgo.com/?t=ffab&q=tracker-miner-fs-3&atb=v443-1&i...
>
> Or check your own system, this looks like it's a completely legitimate package. Whether it's something you want/need or not is another matter but we shouldn't jump to conclusions without some base evidence...
>
> [wmcdonald@fedora ~ ]$ ps -ef | grep [t]racker
> wmcdona+    3673    2022  0 Jan02 ?        00:00:04 /usr/libexec/tracker-miner-fs-3
>
> [wmcdonald@fedora ~ ]$ rpm -qf /usr/libexec/tracker-miner-fs-3
> tracker-miners-3.7.4-2.fc41.x86_64
>
> [wmcdonald@fedora ~ ]$ rpm -qi `rpm -qf /usr/libexec/tracker-miner-fs-3`
> Name        : tracker-miners
> Version     : 3.7.4
> Release     : 2.fc41
> Architecture: x86_64
> Install Date: Thu 02 Jan 2025 14:35:31 GMT
> Group       : Unspecified
> Size        : 4559227
> License     : GPL-2.0-or-later AND LGPL-2.1-or-later
> Signature   : RSA/SHA256, Thu 12 Dec 2024 19:10:53 GMT, Key ID d0622462e99d6ad1
> Source RPM  : tracker-miners-3.7.4-2.fc41.src.rpm
> Build Date  : Thu 12 Dec 2024 15:47:19 GMT
> Build Host  : buildvm-x86-14.iad2.fedoraproject.org
> Packager    : Fedora Project
> Vendor      : Fedora Project
> URL         : https://gnome.pages.gitlab.gnome.org/tracker/
> Bug URL     : https://bugz.fedoraproject.org/tracker-miners
> Summary     : Tracker miners and metadata extractors
> Description :
> Tracker is a powerful desktop-neutral first class object database,
> tag/metadata database and search tool.
>
> This package contains various miners and metadata extractors for tracker.

Oh, it sounded like one of those cryptocurrency miners (to me).

What a dumb name for a legitimate package...

Jeff

[Robin Laing]

On 2025-01-06 11.02, Jeffrey Walton wrote:
> On Mon, Jan 6, 2025 at 1:00 PM Will McDonald  wrote:
> > On Mon, 6 Jan 2025 at 17:50, Jeffrey Walton  wrote:
> > > On Mon, Jan 6, 2025 at 12:36 PM Tim Evans  wrote:
> > > > Have noticed very heavy sluggishness in my F-41 system response over the
> > > > past week or so.  Totally idle system showing steady 1.0+ system load
> > > > average; lightly used system showing 2.0+. Some apps' response delayed
> > > > 30 seconds or longer.
> > > >
> > > > Top shows tracker-miner-fs-3 steady at 18-35% CPU
> > >
> > > I would be interested to learn about how the malware got on your
> > > system. It sounds like it managed to install itself with root
> > > privileges.
> > >
> > > Do you recall what you were doing around the time it showed up or you
> > > experienced the slow down?
> >
> > You might want to slow down before jumping to the 'malware' conclusion.
> >
> > My immediate thought was 'oh, that doesn't sound good', too but if you search for that process name...
> >
> > https://duckduckgo.com/?t=ffab&q=tracker-miner-fs-3&atb=v443-1&i...
> >
> > Or check your own system, this looks like it's a completely legitimate package. Whether it's something you want/need or not is another matter but we shouldn't jump to conclusions without some base evidence...
> >
> > [wmcdonald@fedora ~ ]$ ps -ef | grep [t]racker
> > wmcdona+    3673    2022  0 Jan02 ?        00:00:04 /usr/libexec/tracker-miner-fs-3
> >
> > [wmcdonald@fedora ~ ]$ rpm -qf /usr/libexec/tracker-miner-fs-3
> > tracker-miners-3.7.4-2.fc41.x86_64
> >
> > [wmcdonald@fedora ~ ]$ rpm -qi `rpm -qf /usr/libexec/tracker-miner-fs-3`
> > Name        : tracker-miners
> > Version     : 3.7.4
> > Release     : 2.fc41
> > Architecture: x86_64
> > Install Date: Thu 02 Jan 2025 14:35:31 GMT
> > Group       : Unspecified
> > Size        : 4559227
> > License     : GPL-2.0-or-later AND LGPL-2.1-or-later
> > Signature   : RSA/SHA256, Thu 12 Dec 2024 19:10:53 GMT, Key ID d0622462e99d6ad1
> > Source RPM  : tracker-miners-3.7.4-2.fc41.src.rpm
> > Build Date  : Thu 12 Dec 2024 15:47:19 GMT
> > Build Host  : buildvm-x86-14.iad2.fedoraproject.org
> > Packager    : Fedora Project
> > Vendor      : Fedora Project
> > URL         : https://gnome.pages.gitlab.gnome.org/tracker/
> > Bug URL     : https://bugz.fedoraproject.org/tracker-miners
> > Summary     : Tracker miners and metadata extractors
> > Description :
> > Tracker is a powerful desktop-neutral first class object database,
> > tag/metadata database and search tool.
> >
> > This package contains various miners and metadata extractors for tracker.
>
> Oh, it sounded like one of those cryptocurrency miners (to me).
>
> What a dumb name for a legitimate package...
>
> Jeff

It is a logical name for what it does.  It tracks data on your system by 
mining the metadata that it can process.  It is part of the process of 
trying to be helpful.

I have found it to be an issue and a "tool" that I don't use.  I removed 
it as soon as I found that what it was doing and the resources that it 
was taking up.  No loss for my processes.

So, if you are not using it's features, remove it, if you can.  I use 
KDE which may allow me to remove it.

Robin

[Tim Evans]

On 1/6/25 1:00 PM, Will McDonald wrote:
> On Mon, 6 Jan 2025 at 17:50, Jeffrey Walton <[e-mail] 
> > wrote:
> On Mon, Jan 6, 2025 at 12:36 PM Tim Evans <[e-mail]
> <mailto:[e-mail]>> wrote:
>  >
>  > Have noticed very heavy sluggishness in my F-41 system response
> over the
>  > past week or so.  Totally idle system showing steady 1.0+ system load
>  > average; lightly used system showing 2.0+. Some apps' response
> delayed
>  > 30 seconds or longer.
>  >
>  > Top shows tracker-miner-fs-3 steady at 18-35% CPU
>
> I would be interested to learn about how the malware got on your
> system. It sounds like it managed to install itself with root
> privileges.
>
> Do you recall what you were doing around the time it showed up or you
> experienced the slow down?
>
>
> You might want to slow down before jumping to the 'malware' conclusion.
>
> [wmcdonald@fedora ~ ]$ rpm -qi `rpm -qf /usr/libexec/tracker-miner-fs-3`
> Name        : tracker-miners
> Version     : 3.7.4
> Release     : 2.fc41
> Architecture: x86_64
> Install Date: Thu 02 Jan 2025 14:35:31 GMT
> Group       : Unspecified
> Size        : 4559227
> License     : GPL-2.0-or-later AND LGPL-2.1-or-later
> Signature   : RSA/SHA256, Thu 12 Dec 2024 19:10:53 GMT, Key ID 
> d0622462e99d6ad1
> Source RPM  : tracker-miners-3.7.4-2.fc41.src.rpm
> Build Date  : Thu 12 Dec 2024 15:47:19 GMT
> Build Host  : buildvm-x86-14.iad2.fedoraproject.org <http://buildvm- 
> x86-14.iad2.fedoraproject.org>
> Packager    : Fedora Project
> Vendor      : Fedora Project
> URL         : https://gnome.pages.gitlab.gnome.org/tracker/ <https:// 
> gnome.pages.gitlab.gnome.org/tracker/>
> Bug URL     : https://bugz.fedoraproject.org/tracker-miners <https:// 
> bugz.fedoraproject.org/tracker-miners>
> Summary     : Tracker miners and metadata extractors
> Description :
> Tracker is a powerful desktop-neutral first class object database,
> tag/metadata database and search tool.

Yeah, clearly installed via dnf in some routine update, in my case in 
mid-December.  I see it on two other local systems here, but it's not 
running continuously on them, just on the one system.  Must be a config 
somewhere, but the man page doesn't mention any configuration files, 
just some startup and debug options.  Wonder if it's crawling across NFS 
mounts to my NAS?

[Tim Evans]

On 1/6/25 2:28 PM, Robin Laing wrote:
> It is a logical name for what it does.  It tracks data on your system by 
> mining the metadata that it can process.  It is part of the process of 
> trying to be helpful.
>
> I have found it to be an issue and a "tool" that I don't use.  I removed 
> it as soon as I found that what it was doing and the resources that it 
> was taking up.  No loss for my processes.
>
> So, if you are not using it's features, remove it, if you can.  I use 
> KDE which may allow me to remove it.

dnf wants to remove a batch of Gnome stuff, including Nautilus, which it 
calls dependencies, along with it.

[Will McDonald]

On Mon, 6 Jan 2025 at 19:33, Tim Evans  wrote:
> On 1/6/25 1:00 PM, Will McDonald wrote:
> > [wmcdonald@fedora ~ ]$ rpm -qi `rpm -qf /usr/libexec/tracker-miner-fs-3`
> > Name        : tracker-miners
> > Version     : 3.7.4
> > Release     : 2.fc41
> > Architecture: x86_64
> > Install Date: Thu 02 Jan 2025 14:35:31 GMT
> > Group       : Unspecified
> > Size        : 4559227
> > License     : GPL-2.0-or-later AND LGPL-2.1-or-later
> > Signature   : RSA/SHA256, Thu 12 Dec 2024 19:10:53 GMT, Key ID
> > d0622462e99d6ad1
> > Source RPM  : tracker-miners-3.7.4-2.fc41.src.rpm
> > Build Date  : Thu 12 Dec 2024 15:47:19 GMT
> > Build Host  : buildvm-x86-14.iad2.fedoraproject.org http://buildvm-
> > x86-14.iad2.fedoraproject.org
> > Packager    : Fedora Project
> > Vendor      : Fedora Project
>
> <snip>
> Yeah, clearly installed via dnf in some routine update, in my case in
> mid-December.  I see it on two other local systems here, but it's not
> running continuously on them, just on the one system.  Must be a config
> somewhere, but the man page doesn't mention any configuration files,
> just some startup and debug options.  Wonder if it's crawling across NFS
> mounts to my NAS?

Some of the first few links from the DDG search might be worth reviewing:

This is for Ubuntu and the
https://stackoverflow.com/questions/72827703/how-to-disable-file-indexing-in...

[wmcdonald@fedora ~ ]$ rpm -qc tracker-miners
/etc/xdg/autostart/tracker-miner-fs-3.desktop
/etc/xdg/autostart/tracker-miner-rss-3.desktop

[wmcdonald@fedora ~ ]$ cat /etc/xdg/autostart/tracker-miner-fs-3.desktop
[Desktop Entry]
Name=Tracker File System Miner
Comment=Crawls and processes files on the file system
Exec=/usr/libexec/tracker-miner-fs-3
Terminal=false
Type=Application
Categories=Utility;
X-GNOME-Autostart-enabled=true
X-GNOME-HiddenUnderSystemd=true
X-KDE-autostart-after=panel
X-KDE-StartupNotify=false
X-KDE-UniqueApplet=true
NoDisplay=true
OnlyShowIn=GNOME;KDE;XFCE;X-IVI;Unity;
X-systemd-skip=true

It seems odd that just disabling/masking the systemd services isn't
sufficient but maybe flipping X-GNOME-Autostart-enabled=true to false might
also help.

These might also be of interest:

https://discussion.fedoraproject.org/t/how-to-disable-tracker-miner/66220/10
https://discussion.fedoraproject.org/t/tracker3-tracker-miner-fs-3-constantl...
https://unix.stackexchange.com/questions/694065/how-to-really-completely-dis...

[sorelz]

On Mon, 2025-01-06 at 14:33 -0500, Tim Evans wrote:
> Must be a config 
> somewhere, but the man page doesn't mention any configuration files, 
> just some startup and debug options.

You can change the crawling settings through dconf (either with dconf-
editor or the dconf CLI); its under
/org/freedesktop/tracker/miner/files.

If memory serves me correct I fixed this by disabling the tracker-
miner-fs-3.service file; but it only appears with the '--user' option
to systemctl:
> > systemctl --user status tracker-miner-fs-3

○ tracker-miner-fs-3.service - Tracker file system data miner
     Loaded: loaded (/usr/lib/systemd/user/tracker-miner-fs-3.service;
disabled; preset: disabled)
    Drop-In: /usr/lib/systemd/user/tracker-.service.d
             └─00-uresourced.conf
             /usr/lib/systemd/user/service.d
             └─10-timeout-abort.conf
     Active: inactive (dead)

Nautilus has tracker-miners as a dependency, if you remove tracker
entirely then its search function won't work anymore (in my
experience).