Strange CD/DVD drive activity?

Questions about applications and software
Forum rules
Before you post please read how to get help
Post Reply
User avatar
turboscrew
Level 4
Level 4
Posts: 214
Joined: Sat Sep 26, 2009 2:13 pm

Strange CD/DVD drive activity?

Post by turboscrew » Tue Feb 21, 2017 6:01 am

There has been some weird activity on my machine lately, and I wonder what that could be and how to find out.

After being ON for a couple of days (put to suspend when not used), there 'sounds to be' some CD/DVD drive activity all of a sudden, and that
happens every now and then, maybe a couple of hours apart. How can I find out what's going on?
The 'lsof' doesn't show anything and I don't even have a CD/DVD in the drive. A moment ago, the machine just decided to eject by itself!
As if someone/something is spying on my machine.
who (as a super user) didn't show anything suspicious and I didn't find anything striking in the 'ps -aux' either.

My network should be safe (I do have a firewall in my ADSL modem/router).

Is there a way to find out who (which program) is accessing my CD/DVD drive?
Or should I do some heavy updating - or even reinstall (hope not)?

User avatar
Moem
Level 19
Level 19
Posts: 9541
Joined: Tue Nov 17, 2015 9:14 am
Location: The Netherlands
Contact:

Re: Strange CD/DVD drive activity?

Post by Moem » Tue Feb 21, 2017 7:27 am

Just a thought, but is your update manager configured to look to the CD drive for updates?
Image

If your issue is solved, kindly indicate that by editing the first post in the topic, and adding [SOLVED] to the title. Thanks!

Cosmo.
Level 23
Level 23
Posts: 17830
Joined: Sat Dec 06, 2014 7:34 am

Re: Strange CD/DVD drive activity?

Post by Cosmo. » Tue Feb 21, 2017 8:02 am

As the system is running for several days, it appears likely, that you have a greater number of applications open. Impossible to tell from the distant, which they are and which of them might try to access the drive.

I suggest to close all open applications and reopen only as few as possible; make at first a written list of the applications, which are open, so that you can later try to reproduce the problem. If the problem should be gone, it is one of the programs from your list. If the problem should persist, log out and back into your account and watch, if this helps.

User avatar
turboscrew
Level 4
Level 4
Posts: 214
Joined: Sat Sep 26, 2009 2:13 pm

Re: Strange CD/DVD drive activity?

Post by turboscrew » Tue Feb 21, 2017 11:21 am

At least the "CD-ROM (Installation Disk)" in "Additional repositories" is not selected.

The applications that I've been using lately are Firefox, Chrome, Gnome terminal, gedit, Document Viewer Nemo and Gtkterm.
(Chrome, because Firefox can't handle the TV-guide I'm using. And pretty much ONLY for that.)

Most often I only have Firefox open (with only facebook open).

I wonder if it's possible to find out who's using /dev/cdrom while the activity is going on?
(It hasn't ejected before. I hope my machine is not hijacked or something... On the other hand, I wonder how that would have been possible...)

User avatar
turboscrew
Level 4
Level 4
Posts: 214
Joined: Sat Sep 26, 2009 2:13 pm

Re: Strange CD/DVD drive activity?

Post by turboscrew » Mon Mar 06, 2017 7:52 pm

I tried blktrace/blkparse ('blktrace -d /dev/cdrom -o cdrom.trc') and got:

Code: Select all

11,0    0        1     0.000000000 14998  G   N [kworker/u8:2]
 11,0    0        2     0.000011384 14998  I   R 8 (4a 01 00 00 10 00 00 00 08 0
0 ..) [kworker/u8:2]
 11,0    0        3     0.000014667 14998  D   R 8 (4a 01 00 00 10 00 00 00 08 0
0 ..) [kworker/u8:2]
 11,0    0        4     0.001878940     0  C   R (4a 01 00 00 10 00 00 00 08 00 
..) [0]
 11,0    0        5     2.047962454 14998  G   N [kworker/u8:2]
 11,0    0        6     2.047977330 14998  I   R 8 (4a 01 00 00 10 00 00 00 08 0
0 ..) [kworker/u8:2]
 11,0    0        7     2.047980333 14998  D   R 8 (4a 01 00 00 10 00 00 00 08 0
0 ..) [kworker/u8:2]
 11,0    0        8     2.049844607     0  C   R (4a 01 00 00 10 00 00 00 08 00 
..) [0]
 11,0    0        9     4.095969606 14998  G   N [kworker/u8:2]
 11,0    0       10     4.095980501 14998  I   R 8 (4a 01 00 00 10 00 00 00 08 0
0 ..) [kworker/u8:2]
 11,0    0       11     4.095983435 14998  D   R 8 (4a 01 00 00 10 00 00 00 08 0
0 ..) [kworker/u8:2]
 11,0    0       12     4.097848197     0  C   R (4a 01 00 00 10 00 00 00 08 00 

Even if the CD/DVD drive didn't sound like doing something.
'ps -ejH' showed 'kworker/u8:2' under kthreadd with different PID (there didn't seem to be PID 14998):

Code: Select all

17595     0     0 ?        00:00:00   kworker/u8:2
Any idea where to go from here?
That is: what is this 'kworker/u8:2'? What does it do? Whom does it work for? And how to find out?

It's loginuid seems to be 4294967295. (From /proc/<PID>/loginuid. The PID seems to change every now and then.)

I'll check if it's the same process (thread, really) next time I hear the weird CDROM activity.

User avatar
turboscrew
Level 4
Level 4
Posts: 214
Joined: Sat Sep 26, 2009 2:13 pm

Re: Strange CD/DVD drive activity?

Post by turboscrew » Tue Mar 07, 2017 7:22 am

Now with some sounds with strange cdrom activity...
Only kworker/u8:2 and kworker/u8:1 found with the same activities. I can't understand the difference: something was different because now there was the
"seek sound", previously there wasn't.

Here's the end of the new blkparsed blktrace of /dev/cdrom.

Code: Select all

11,0    0     2624  3153.919968815 21344  G   N [kworker/u8:1]
 11,0    0     2625  3153.919975659 21344  I   R 8 (4a 01 00 00 10 00 00 00 08 00 ..) [kworker/u8:1]
 11,0    0     2626  3153.919977754 21344  D   R 8 (4a 01 00 00 10 00 00 00 08 00 ..) [kworker/u8:1]
 11,0    0     2627  3153.921798866     0  C   R (4a 01 00 00 10 00 00 00 08 00 ..) [0]
 11,0    1     3538  3155.967946215 21344  G   N [kworker/u8:1]
 11,0    1     3539  3155.967954107 21344  I   R 8 (4a 01 00 00 10 00 00 00 08 00 ..) [kworker/u8:1]
 11,0    1     3540  3155.967956202 21344  D   R 8 (4a 01 00 00 10 00 00 00 08 00 ..) [kworker/u8:1]
 11,0    0     2628  3155.969770818     0  C   R (4a 01 00 00 10 00 00 00 08 00 ..) [0]
CPU0 (cdrom.trc):
 Reads Queued:           0,        0KiB	 Writes Queued:           0,        0KiB
 Read Dispatches:        0,        0KiB	 Write Dispatches:        0,        0KiB
 Reads Requeued:         0		 Writes Requeued:         0
 Reads Completed:        0,        0KiB	 Writes Completed:        0,        0KiB
 Read Merges:            0,        0KiB	 Write Merges:            0,        0KiB
 Read depth:             1        	 Write depth:             0
 PC Reads Queued:        0,        0KiB	 PC Writes Queued:        0,        0KiB
 PC Read Disp.:        362,        0KiB	 PC Write Disp.:          0,        0KiB
 PC Reads Req.:          0		 PC Writes Req.:          0
 PC Reads Compl.:     1542		 PC Writes Compl.:        0
 IO unplugs:             0        	 Timer unplugs:           0
CPU1 (cdrom.trc):
 Reads Queued:           0,        0KiB	 Writes Queued:           0,        0KiB
 Read Dispatches:        0,        0KiB	 Write Dispatches:        0,        0KiB
 Reads Requeued:         0		 Writes Requeued:         0
 Reads Completed:        0,        0KiB	 Writes Completed:        0,        0KiB
 Read Merges:            0,        0KiB	 Write Merges:            0,        0KiB
 Read depth:             1        	 Write depth:             0
 PC Reads Queued:        0,        0KiB	 PC Writes Queued:        0,        0KiB
 PC Read Disp.:       1180,        0KiB	 PC Write Disp.:          0,        0KiB
 PC Reads Req.:          0		 PC Writes Req.:          0
 PC Reads Compl.:        0		 PC Writes Compl.:        0
 IO unplugs:             0        	 Timer unplugs:           0

Total (cdrom.trc):
 Reads Queued:           0,        0KiB	 Writes Queued:           0,        0KiB
 Read Dispatches:        0,        0KiB	 Write Dispatches:        0,        0KiB
 Reads Requeued:         0		 Writes Requeued:         0
 Reads Completed:        0,        0KiB	 Writes Completed:        0,        0KiB
 Read Merges:            0,        0KiB	 Write Merges:            0,        0KiB
 PC Reads Queued:        0,        0KiB	 PC Writes Queued:        0,        0KiB
 PC Read Disp.:       1542,        0KiB	 PC Write Disp.:          0,        0KiB
 PC Reads Req.:          0		 PC Writes Req.:          0
 PC Reads Compl.:     1542		 PC Writes Compl.:        0
 IO unplugs:             0        	 Timer unplugs:           0

Throughput (R/W): 0KiB/s / 0KiB/s
Events (cdrom.trc): 6168 entries
Skips: 0 forward (0 -   0.0%)

User avatar
austin.texas
Level 20
Level 20
Posts: 12054
Joined: Tue Nov 17, 2009 3:57 pm
Location: at /home

Re: Strange CD/DVD drive activity?

Post by austin.texas » Tue Mar 07, 2017 9:03 am

kworker is a part of your OS. The k stands for kernel
This discussion might provide a clue for the excessive access attempts.
I think the bottom line there is: try a different kernel.
Mint 18.2 Cinnamon, Quad core AMD A8-3870 with Radeon HD Graphics 6550D, 8GB DDR3, Ralink RT2561/RT61 802.11g PCI
Linux Linx 2018

User avatar
turboscrew
Level 4
Level 4
Posts: 214
Joined: Sat Sep 26, 2009 2:13 pm

Re: Strange CD/DVD drive activity?

Post by turboscrew » Tue Mar 07, 2017 11:13 am

Yes, and it's a worker thread, but which process does it work for, or how to find out?
My problem is not a kworker hogging too much resources. I just wonder why it's accessing my CD drive every now and then.
(You hear a "seek-like" sound, the led is blinking etc. An once it ejected by itself.)

My other Linux distros (Debian 8.3, Slackware 14.1) don't do that.
This is

Code: Select all

$ inxi -F
System:    Host: T400 Kernel: 3.19.0-32-generic x86_64 (64 bit)
           Desktop: Cinnamon 2.8.8  Distro: Linux Mint 17.3 Rosa
I just wondered if there's something running in my machine that shouldn't (a spy?), but how to find out?

User avatar
cryptic57
Level 1
Level 1
Posts: 31
Joined: Sat Aug 03, 2013 3:36 pm

Re: Strange CD/DVD drive activity?

Post by cryptic57 » Tue Mar 07, 2017 1:06 pm

turboscrew wrote:
I just wondered if there's something running in my machine that shouldn't (a spy?), but how to find out?
Perhaps you should read about the latest Wikileaks document dump concerning the activities of the CIA and their spy-ware.
http://www.smh.com.au/world/wikileaks-r ... usyvh.html
It may not be a joke.

User avatar
turboscrew
Level 4
Level 4
Posts: 214
Joined: Sat Sep 26, 2009 2:13 pm

Re: Strange CD/DVD drive activity?

Post by turboscrew » Tue Mar 07, 2017 2:12 pm

If it is CIA then they really got a wrong guy. A harmless unemployed Finn. :lol:

User avatar
austin.texas
Level 20
Level 20
Posts: 12054
Joined: Tue Nov 17, 2009 3:57 pm
Location: at /home

Re: Strange CD/DVD drive activity?

Post by austin.texas » Tue Mar 07, 2017 3:24 pm

turboscrew wrote:If it is CIA then they really got a wrong guy. A harmless unemployed Finn. :lol:
Yes, We know.
Mint 18.2 Cinnamon, Quad core AMD A8-3870 with Radeon HD Graphics 6550D, 8GB DDR3, Ralink RT2561/RT61 802.11g PCI
Linux Linx 2018

User avatar
turboscrew
Level 4
Level 4
Posts: 214
Joined: Sat Sep 26, 2009 2:13 pm

Re: Strange CD/DVD drive activity?

Post by turboscrew » Mon Mar 13, 2017 5:12 am

This time something else (and also a "spontaneous" eject):

Code: Select all

11,0    1        6     0.001517093  4726  D   R 8 (46 00 00 00 00 00 00 00 08 00 ..) [cdrom_id]
 11,0    0        3     0.003364674     0  C   R (46 00 00 00 00 00 00 00 08 00 ..) [0]
 11,0    1        7     0.003385068  4726  G   N [cdrom_id]
 11,0    1        8     0.003387233  4726  I   R 364 (46 00 00 00 00 00 00 01 6c 00 ..) [cdrom_id]
 11,0    1        9     0.003388350  4726  D   R 364 (46 00 00 00 00 00 00 01 6c 00 ..) [cdrom_id]
 11,0    0        4     0.006656434     0  C   R (46 00 00 00 00 00 00 01 6c 00 ..) [0]
 11,0    0        5     0.006726903  4592  G   N [kworker/u8:1]
 11,0    0        6     0.006730605  4592  I   R 8 (4a 01 00 00 10 00 00 00 08 00 ..) [kworker/u8:1]
 11,0    0        7     0.006731932  4592  D   R 8 (4a 01 00 00 10 00 00 00 08 00 ..) [kworker/u8:1]
 11,0    0        8     0.013210689     0  C   R (4a 01 00 00 10 00 00 00 08 00 ..) [0]
 11,0    0        9     0.013227451  4592  G   N [kworker/u8:1]
 11,0    0       10     0.013229057  4592  I   N 0 (00 ..) [kworker/u8:1]
 11,0    0       11     0.013230454  4592  D   N 0 (00 ..) [kworker/u8:1]
 11,0    0       12     0.127986457   163  C   N (00 ..) [2]
 11,0    1       10     0.128051061  4729  G   N [ata_id]
 11,0    1       11     0.128059372  4729  I   R 8 (4a 01 00 00 10 00 00 00 08 00 ..) [ata_id]
 11,0    1       12     0.128061257  4729  D   R 8 (4a 01 00 00 10 00 00 00 08 00 ..) [ata_id]
 11,0    0       13     0.134495875     0  C   R (4a 01 00 00 10 00 00 00 08 00 ..) [0]
 11,0    1       13     0.134535684  4729  G   N [ata_id]
 11,0    1       14     0.134537430  4729  I   N 0 (00 ..) [ata_id]
 11,0    1       15     0.134538967  4729  D   N 0 (00 ..) [ata_id]
 11,0    0       14     0.247921402   163  C   N (00 ..) [2]
 11,0    0       15     0.247961141  4729  G   N [ata_id]

Post Reply

Return to “Software & Applications”