I've been intermittently attempting to solve (or at least explain) this for about a week, and I'm running out of ideas so I was hoping to get some help.
The problem: Upon a fresh boot, the system utilizes about ~50 MB of memory (presumably allocated by the kernel). After a period of 2 hours or so, memory usage jumps up to somewhere between 180 MB and 230 MB, but no processes seem so be using this memory.
I'll provide as much detailed information as I can. I've disabled most services to try and hunt down the issue.
System Information
FreeBSD 10.2-RELEASE-p9
CPU: 2x Virtual CPU e7da7129d3ee (2398.86-MHz K8-class CPU) (amd64)
Real Mem: 2048 MB
Avail Mem: 1955 MB
Hypervisor: KVM
/etc/rc.conf
I have also emptied the contents of /etc/sysctl.conf and /boot/loader.conf.
Memory Usage (Various Sources)
Process Information
Things I've Tried
The problem: Upon a fresh boot, the system utilizes about ~50 MB of memory (presumably allocated by the kernel). After a period of 2 hours or so, memory usage jumps up to somewhere between 180 MB and 230 MB, but no processes seem so be using this memory.
I'll provide as much detailed information as I can. I've disabled most services to try and hunt down the issue.
System Information
FreeBSD 10.2-RELEASE-p9
CPU: 2x Virtual CPU e7da7129d3ee (2398.86-MHz K8-class CPU) (amd64)
Real Mem: 2048 MB
Avail Mem: 1955 MB
Hypervisor: KVM
/etc/rc.conf
Code:
# Hostname
hostname="*redacted*"
# Networking
ifconfig_vtnet0="dhcp"
ifconfig_vtnet0_ipv6="inet6 accept_rtadv"
ipv6_activate_all_interfaces=YES
route_linklocal="-net 169.254.0.0/16 -interface vtnet0"
rtsold_enable=YES
rtsold_flags="-aF"
static_routes=linklocal
# Enabled Services
sshd_enable="YES"
# Disabled Services
sendmail_enable="NO"
sendmail_msp_queue_enable="NO"
sendmail_outbound_enable="NO"
sendmail_submit_enable="NO"Memory Usage (Various Sources)
Code:
# top
Mem: 2900K Active, 212M Inact, 183M Wired, 1984K Cache, 212M Buf, 1572M Free
Code:
# freecolor -m -o
total used free shared buffers cached
Mem: 1971 185 1786 0 0 1
Code:
# perl freebsd-memory.pl
SYSTEM MEMORY INFORMATION:
mem_wire: 191602688 ( 182MB) [ 9%] Wired: disabled for paging out
mem_active: + 3657728 ( 3MB) [ 0%] Active: recently referenced
mem_inactive:+ 226435072 ( 215MB) [ 10%] Inactive: recently not referenced
mem_cache: + 2031616 ( 1MB) [ 0%] Cached: almost avail. for allocation
mem_free: + 1643261952 ( 1567MB) [ 79%] Free: fully available for allocation
mem_gap_vm: + 4096 ( 0MB) [ 0%] Memory gap: UNKNOWN
-------------- ------------ ----------- ------
mem_all: = 2066993152 ( 1971MB) [100%] Total real memory managed
mem_gap_sys: + 55013376 ( 52MB) Memory gap: Kernel?!
-------------- ------------ -----------
mem_phys: = 2122006528 ( 2023MB) Total real memory available
mem_gap_hw: + 25477120 ( 24MB) Memory gap: Segment Mappings?!
-------------- ------------ -----------
mem_hw: = 2147483648 ( 2048MB) Total real memory installed
SYSTEM MEMORY SUMMARY:
mem_used: 275755008 ( 262MB) [ 12%] Logically used memory
mem_avail: + 1871728640 ( 1785MB) [ 87%] Logically available memory
-------------- ------------ ----------- ------
mem_total: = 2147483648 ( 2048MB) [100%] Logically total memory
Code:
# ps -duxm
USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
root 0 0.0 0.0 0 208 - DLs Sat11AM 0:00.45 [kernel]
root 1 0.0 0.0 9476 852 - ILs Sat11AM 0:00.02 - /sbin/init --
root 364 0.0 0.2 13624 4712 - Is Sat11AM 0:00.18 |-- /sbin/devd
root 646 0.0 0.3 61224 6572 - Is Sat11AM 0:00.01 |-- /usr/sbin/sshd
root 8021 0.0 0.3 86492 7164 - Ss 5:41PM 0:00.19 | `-- sshd: root@pts/0 (sshd)
root 8023 0.0 0.2 23592 3364 0 Ss 5:41PM 0:00.05 | `-- -tcsh (tcsh)
root 8129 0.0 0.1 18760 2168 0 R+ 5:51PM 0:00.00 | `-- ps -duxm
root 458 0.0 0.1 14512 2100 - Ss Sat11AM 0:00.77 |-- /usr/sbin/syslogd -s
root 650 0.0 0.1 16612 2228 - Ss Sat11AM 0:01.20 |-- /usr/sbin/cron -s
root 413 0.0 0.1 14456 1856 - Is Sat11AM 0:00.01 |-- /usr/sbin/rtsold -aF
root 696 0.0 0.1 47744 2792 v0 Is Sat11AM 0:00.05 `-- login [pam] (login)
root 7968 0.0 0.2 23592 3368 v0 I+ 5:40PM 0:00.02 `-- -tcsh (tcsh)
root 2 0.0 0.0 0 32 - DL Sat11AM 0:00.85 - [cam]
root 3 0.0 0.0 0 16 - DL Sat11AM 0:00.00 - [sctp_iterator]
root 4 0.0 0.0 0 32 - DL Sat11AM 0:01.52 - [pagedaemon]
root 5 0.0 0.0 0 16 - DL Sat11AM 0:00.00 - [vmdaemon]
root 6 0.0 0.0 0 16 - DL Sat11AM 0:00.01 - [pagezero]
root 7 0.0 0.0 0 32 - DL Sat11AM 0:03.61 - [bufdaemon]
root 8 0.0 0.0 0 16 - DL Sat11AM 0:01.04 - [vnlru]
root 9 0.0 0.0 0 16 - DL Sat11AM 1:27.97 - [syncer]
root 10 0.0 0.0 0 16 - DL Sat11AM 0:00.00 - [audit]
root 11 199.2 0.0 0 32 - RL Sat11AM 6542:13.09 - [idle]
root 12 0.0 0.0 0 304 - WL Sat11AM 1:36.44 - [intr]
root 13 0.0 0.0 0 48 - DL Sat11AM 0:00.01 - [geom]
root 14 0.0 0.0 0 16 - DL Sat11AM 0:30.97 - [rand_harvestq]
root 15 0.0 0.0 0 64 - DL Sat11AM 0:01.80 - [usb]
root 375 0.0 0.0 0 16 - DL Sat11AM 0:41.28 - [pf purge]
root 627 0.0 0.0 0 16 - DL Sat11AM 0:00.00 - [md99]- Rebooting
- Scanning for rootkits with rkhunter
- Disabling most processes (including rtsold, syslog, cron, and ssh)
- Accounting for the memory usage
- Disabling networking
- Sifting through log files for signs of malicious logins
) and oranges. You need to take a very close look at what 
