# 100% Processor Usage **URL:** \ **Category:** SLES SAP Applications\ **Created:** [February 24, 2014, 2:54am UTC](https://forums.suse.com/t/100-processor-usage/25172 "2014-02-24T02:54:23Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![tdphanab1](https://avatars.discourse-cdn.com/v4/letter/t/edb3f5/32.png) [@tdphanab1](https://forums.suse.com/u/tdphanab1)\ **Post date:** [February 24, 2014, 2:54am UTC](https://forums.suse.com/t/100-processor-usage/25172/1 "2014-02-24T02:54:23Z")
My SLES only installed SAP HANA, every morning processor status always reach 100% all, I see it on System Status Monitor. and at night surely no one using the SAP apps. So every morning I have to restart the server to get it normal. Any idea how to check what makes the processor 100% usage ? Thanks ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [February 24, 2014, 1:08pm UTC](https://forums.suse.com/t/100-processor-usage/25172/2 "2014-02-24T13:08:46Z")
Have you tried the typical OS tools like ‘top’ to see what is using the system? Which SLES version and patches? Is this production, dev, QA, etc. and does it happen in other environments? Is anything misbehaving other than the perceived problem with CPU utilization? Is this a physical or virtual box? How many CPUs/cores/etc. does it have? – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below… ---
**Author:** ![tdphanab1](https://avatars.discourse-cdn.com/v4/letter/t/edb3f5/32.png) [@tdphanab1](https://forums.suse.com/u/tdphanab1)\ **Post date:** [February 26, 2014, 5:22am UTC](https://forums.suse.com/t/100-processor-usage/25172/3 "2014-02-26T05:22:07Z")
I am using 2 Xeon 8Core, I try run TOP and it is stated that m64.pl taking much process. what is m64.pl ? thanks ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [February 26, 2014, 6:01am UTC](https://forums.suse.com/t/100-processor-usage/25172/4 "2014-02-26T06:01:03Z")
On 02/25/2014 08:24 PM, tdphanab1 wrote:[color=blue] > I am using 2 Xeon 8Core, I try run TOP and it is stated that m64.pl > taking much process. what is m64.pl ? > thanks[/color] No idea. Which package is it from? Find out the file’s path and then see which package placed it. If one did not, then you may want to disconnect your system and see if it has been hacked. The m64.pl process shows up in Google as possibly being a bit of malware used as a bitcoin miner, which means somebody is making money by using your CPU to do bitcoin “mining”. [https://www.virustotal.com/en/file/ae3e78a63168088360f40dcb3397135e25b85e1cdfc690eb9b409cd1f92c737c/analysis/](https://www.virustotal.com/en/file/ae3e78a63168088360f40dcb3397135e25b85e1cdfc690eb9b409cd1f92c737c/analysis/) – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below… ---
**Author:** ![tdphanab1](https://avatars.discourse-cdn.com/v4/letter/t/edb3f5/32.png) [@tdphanab1](https://forums.suse.com/u/tdphanab1)\ **Post date:** [February 26, 2014, 8:10am UTC](https://forums.suse.com/t/100-processor-usage/25172/5 "2014-02-26T08:10:28Z")
So any guidence to solved this issue ? I activated SSH server on my SLES maybe this is the problem ? so I have to disable the SSH ? ---
**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\ **Post date:** [February 26, 2014, 12:17pm UTC](https://forums.suse.com/t/100-processor-usage/25172/6 "2014-02-26T12:17:06Z")
Hi tdphanab1, [QUOTE=ab;19554][…] then you may want to disconnect your system and see if it has been hacked. The m64.pl process shows up in Google as possibly being a bit of malware used as a bitcoin miner, which means somebody is making money by using your CPU to do bitcoin “mining”. [https://www.virustotal.com/en/file/ae3e78a63168088360f40dcb3397135e25b85e1cdfc690eb9b409cd1f92c737c/analysis/](https://www.virustotal.com/en/file/ae3e78a63168088360f40dcb3397135e25b85e1cdfc690eb9b409cd1f92c737c/analysis/)[/QUOTE] > [@tdphanab1;19555](#): > > So any guidence to solved this issue ? I activated SSH server on my SLES maybe this is the problem ? so I have to disable the SSH ? typical CERT procedures apply. Check where that m64.pl is coming from and where it is placed. If you cannot safely determine “someone from the inside” has placed and started that program, but have to fear your system was compromised, detach it from all networks and start analysis. If you then conclude your system was broken into, try to identify the attack vector (to make sure you won’t open that “hole” again), try to find out if more than BTC mining was added (i.e. the system was used to attack further systems on your network) and then reinstall the server. The decision not to re-install ought only be made if you’re sufficiently sure what had been done and that the system is still “safe” - no back-doors, no malware, no new accounts, all security holes covered,… Regards, Jens