Unknown process.. I cant find an answer on google, duckduckgo or anywhere.. "uas"

[Marie SWE]

Hi Gurus

You that know almost everything about Debian and Linux and have much more experience then me.

I have a root process named "uas" i cant find what it is or what it's for.
uas.. it is a child process of kthreadd.

Code: Select all

user@a73s:~$ ps -o ppid= 151689
      2
user@a73s:~$ cat /proc/151689/stat
151689 (uas) I 2 0 0 0 -1 69238880 0 0 0 0 0 0 0 0 39 19 1 0 38342313 0 0 18446744073709551615 0 0 0 0 0 0 0 2147483647 0 0 0 0 17 2 0 0 0 0 0 0 0 0 0 0 0 0 0
user@a73s:~$ 

Sorry for the image is in swedish, but I'm guessing you guys know your linux so you know what it should say in english on those rows
If not, just say the word and i make an translation for you.
.

I have an uptime of 25days and 12hours, so i started my computer on the 21st of February, so the "uas" process started 4½ days later.. i have not installed anything or run any updates.. so i have no clues of what it is, and my logs do not say anything about the 26th at that time.
The only thing i did find that matches that time is

Code: Select all

2024-02-26T00:12:45.220732+01:00 a73s pkexec: pam_unix(polkit-1:session): session opened for user root(uid=0) by (uid=1000)
2024-02-26T00:12:45.226902+01:00 a73s pkexec[151715]: user: Executing command [USER=root] [TTY=unknown] [CWD=/home/user] [COMMAND=/usr/sbin/xfpm-power-backlight-helper --set-brightness 1]

I tested to boot up a live debian 12 but that one do not have that process, and looking on the properties as the picture shows it gives no clues as normal processes does... it more behave like windows malware, as it want to hide and it is impossible to kill the process "uas".. or even just to temporary stop it is impossible.. i can change the priority though from original very high to low. but that's the limit of what is possible to do.
I did try to search the web. but i only found drones on googeling Process uas.
and searching the Debian.org site gave me nothing and there is no package names named uas.

So what is your guessing guru guys?

[sunrat]

Definitely not a guru here but guessing from a search.
uas results show it's a kernel module "USB Attached SCSI" used by some external drives. From https://www.linuxquestions.org/question ... 175730592/
is it listed:

Code: Select all

lsmod | grep -e ^Module -e ^uas

You can remove it as shown in that link, or blacklist it if not needed.

[Marie SWE]

Definitely not a guru here but guessing from a search.
uas results show it's a kernel module "USB Attached SCSI" used by some external drives. From https://www.linuxquestions.org/question ... 175730592/
is it listed:

Code: Select all

lsmod | grep -e ^Module -e ^uas

You can remove it as shown in that link, or blacklist it if not needed.

Interesting that i got the exact same size as that thread with 32768

Code: Select all

user@a73s:~$ lsmod | grep -e ^Module -e ^uas
Module                  Size  Used by
uas                    32768  0
user@a73s:~$ 

I have no USB storage attached and the only one i have used is a 4GB usb stick so the number 32768 dont fit in.

I think this need to be a hint to the debian team to add description to their processes as linux do not have antivirus software and more and more malware start to popup that target Linux systems.. so undescribed processes becomes a problem.
at least rename the process to usb to next debian release as the name uas have no logic to USB storage.. or put the full name on the process "USB_Attached_SCSI" as a google search on UAS is connected to drones and not USB drivers.

So to be nice to others so they dont need to check the link.
Remove uas with

Code: Select all

sudo modprobe --remove --force uas

what i am really interested in is the size dont fit in.. and why the process couldn't be killed not by cli command or the system monitor running in root..
Is there any other options to kill processes in Debian that works when kill -9 and pkill dont work?

[lindi]

user@a73s:~$ cat /proc/151689/stat
151689 (uas) I 2 0 0 0 -1 69238880 0 0 0 0 0 0 0 0 39 19 1 0 38342313 0 0 18446744073709551615 0 0 0 0 0 0 0 2147483647 0 0 0 0 17 2 0 0 0 0 0 0 0 0 0 0 0 0 0

See "man ps" for explanation of the letter "I":

Code: Select all

I    Idle kernel thread

You cannot kill kernel threads with kill, don't worry about them.

[Marie SWE]

user@a73s:~$ cat /proc/151689/stat
151689 (uas) I 2 0 0 0 -1 69238880 0 0 0 0 0 0 0 0 39 19 1 0 38342313 0 0 18446744073709551615 0 0 0 0 0 0 0 2147483647 0 0 0 0 17 2 0 0 0 0 0 0 0 0 0 0 0 0 0

See "man ps" for explanation of the letter "I":

Code: Select all

I    Idle kernel thread

You cannot kill kernel threads with kill, don't worry about them.

I dont know what man ps is.. I'm a windows 30+ year veteran and only a 5+year old noob on linux.
Is there any programs that can kill kernel threads as it can be good to know if i have other processes not responding on kill command.
when i get a process i dont know if its good or bad, i want to kill it in 5 red seconds just to be on the safe side.
It's better with a system crash then having a running malware for hours

[lindi]

"man" is the command to show manual pages. "man ps" shows the manual page of the "ps" command. You can run commands from a terminal emulator.

You cannot kill kernel threads, they are not userspace processes. Also, you really should not kill processes unless you know what they are for, otherwise you will seriously risk breaking yours system.

[CwF]

when i get a process i dont know if its good or bad, i want to kill it in 5 red seconds just to be on the safe side.

That's the exact wrong thing to do. Regardless of your years of experience you first want to learn the many things you don't know, like from reading a man page, and then stop assuming windows- centric lore applies to linux. You want to approach every day with the openness to revise each and every thing you think you know.

Telling you how to kill things is a recipe for disaster and a good way to become the subject of excuse for your misfortune. You will certainly morph the story, any story, to fit your innocence. It will be not what was explained to you exactly, but this other thing that's unrelated and you can't quite remember exactly the cryptic message... Relevant but missing in your story will be windowism based voodoo you attempted to execute on an innocent Debian. This omission will lead all those Debian Guru's around in circles trying to figure out what You did.

sorry @lindi we've been around this block more than once.

[Marie SWE]

when i get a process i dont know if its good or bad, i want to kill it in 5 red seconds just to be on the safe side.

That's the exact wrong thing to do. Regardless of your years of experience you first want to learn the many things you don't know, like from reading a man page, and then stop assuming windows- centric lore applies to linux. You want to approach every day with the openness to revise each and every thing you think you know.

Telling you how to kill things is a recipe for disaster and a good way to become the subject of excuse for your misfortune. You will certainly morph the story, any story, to fit your innocence. It will be not what was explained to you exactly, but this other thing that's unrelated and you can't quite remember exactly the cryptic message... Relevant but missing in your story will be windowism based voodoo you attempted to execute on an innocent Debian. This omission will lead all those Debian Guru's around in circles trying to figure out what You did.

sorry @lindi we've been around this block more than once.

Yes yes and no
Yes it is a disaster killing things you dont know what it is.. Yes it is good to learn things.. But i did try to find information about the process.. as you can see on the picture in the first post.. it do not contain any information about what the process is. no clues at all.
The process number is a high number so its not a base system process as those seldom has numbers over 2000 in ID and even less over 10000 in ID

so i did an assumption this can be a bad process as it did not contain any information as processes usually does like this.
.

and i spent time looking on the debian site for the process UAS and it do not contain any information about that process.
and for manuals.. i looked on the debian site on the published manuals and non of them contain any information about the process UAS.. and if no information is there.. is it really a bad idea to ask if its a bad process?

So dont say we have been down this road as we haven't.

We have had the discussion about GUI's is the future and some bugs and the last one was i needed a stable system for work.
This is a legitimate system question as i did not find any information

I'm really-really-really trying convert to Linux as i do see it as a bright future, as Debian have made big steps over those years i have been using it.. and its almost there.. just a few things i miss and i wish i was a programmer so i could join the develop team.

But I'm just a stupid network crawler and a old win-sysadmin.. So I am as windows nerd as other is linux nerds. I can open the windows taskmanager and just by scrolling i recognize what processes is system and what is user based.. and you guys can see the same in Debian just by scrolling the processes.
and i know you are hundred times better on linux then i am. and thats why i ask you gurus, as i know you know those processes on the the back of your hand, as i know windows.
and yes i did install a tweaked win-server2022 for desktop use on my work computers.. but i still have dualboot with Debian. i can give a tip that Debian OS prober seems not to be able to detect win-server OS..
I still use Debian as main system on my free time laptop in my living room as i still like Debian and i run Linux on my server. So i really trying to get to the Guru level, but i still have 10 or 20year to go before i can get to you guys level.

[Marie SWE]

"man" is the command to show manual pages. "man ps" shows the manual page of the "ps" command. You can run commands from a terminal emulator.

You cannot kill kernel threads, they are not userspace processes. Also, you really should not kill processes unless you know what they are for, otherwise you will seriously risk breaking yours system.

Okay I did not know about man ps being a short cut to that.
I have used the Terminal man command once back in 2018 when i started with Linux.. and i closed it as fast as i opened it, as i prefer text documents so i can open them in word or other text program so i can use the search function to search for key words, then spending hours reading page after page. I seldom have time for long reading.
So i use duckduckgo or google or i download the manuals in txt,doc or pdf format. So i do read the manual when i search for specifics. but i never read cover to cover.

I tested to open the "man ps" in terminal now and i tried to use the search function in the terminal and i did not find anything about UAS there either.
But thanks for the explanation of "man ps" as i didn't understand it was a shortening for it meant (ps - report a snapshot of the current processes.) in the terminal manual.

so i thank you for the explanation of man ps.. i will try to remember that shortening word for the future.

[CwF]

i prefer text documents so i can open them in word or other text program so i can use the search function to search for key words

Code: Select all

 man ps > ps.txt

Then open ps.txt in your preferred text editor.
Of course there are crude and cryptic keystrokes to search in the terminal as explained in man man

Code: Select all

man man

[sunrat]

You're still not quite there.
"man" and "ps" are both names of commands, not shortened anything.
man is the command to show a man page of a process. So man ps will show the man page for the ps command (ok, man is short for manual). You can view a man page for most commands eg.

Code: Select all

man wget
man journalctl

ps is a command to show running processes. To show all running processes:

Code: Select all

ps aux

There are man pages on the internet if you don't want to view them in terminal. Just type man command in your browser search to find the man page for whatever command you are looking for. Of course replace command with the actual command name.

[steve_v]

GUI's is the future

I have used the Terminal man command once back in 2018 when i started with Linux.. and i closed it as fast as i opened it, as i prefer text documents so i can open them in word or other text program so i can use the search function to search for key words, then spending hours reading page after page.

Rather than mucking about piping things into test files, why not try the single-keystroke search function already built into the man page viewer? There's also 'info' for larger manuals, which has advanced features like chapters and links.

Or you could of course just continue making things artificially complicated for yourself by immediately eschewing anything CLI/TUI-based without exploring it properly...