showq high CPU usage

C

costakis

New Member
Apr 20, 2026
12
1
3
Hi,

For the last 3 days I've been having problems with a process called showq run from user _chrony. This process takes too much CPU and spikes from 20 to even 100% CPU.
---------------------------------------------------------------------------------------------------------------
ps aux | grep showq
_chrony 59207 22.5 0.0 43080 5952 ? S< 11:35 3:01 showq -t unix -u
---------------------------------------------------------------------------------------------------------------

Also I am having too many instances of smtp and smtpd running.

Can anyone help ?
 
First thing I’d do is check the mail queue and logs, and verify where the showq binary is coming from. I’d also make sure the server isn’t acting as an open relay. From what you’re describing, it really looks like the system is either being used to send spam or has been compromised.
 
I would be grateful if you could add more details on how to check the things you are describing. Also I have not forwarded any ports to the PVE host.
The binary is coming either from '/var/spool/postfix/public/showq' or from '/usr/lib/postfix/sbin/showq'. To the first path I dont have access even as root.
 
Last edited:
[S]apt autopurge postfix[/S] should work. I use dma myself but if you don't need a MTA that's it. You might have to run pkill postfix showq too or stop the services before.
 
Last edited:
Impact said:
apt autopurge postfix should work. I use dma myself but if you don't need a MTA that's it. You might have to run pkill postfix showq too or stop the services before.
Click to expand...
apt remove postfix shows:

REMOVING:
bsd-mailx postfix proxmox-ve pve-manager

So, 'apt autopurge postfix' will remove pve-manager ? Wont this break my proxmox ?
 
It will. Don't agree. pve-manager depends on a MTA. You can either replace it with dma which has no permanent daemons or mask the service(s).
I'll tell you more in a bit when I'm at a PC.
 
Last edited:
Please don't quote every message. You can see the dependency here
Bash: 
# apt depends pve-manager
|Depends: postfix
  Depends: <mail-transport-agent>
    courier-mta
    dma
    esmtp-run
    exim4-daemon-heavy
    exim4-daemon-light
    msmtp-mta
    nullmailer
    opensmtpd
    postfix
    sendmail-bin
    ssmtp
Mail is kinda important. The postfix package provides these services
Bash: 
# dpkg -L postfix | grep ".service"
/usr/lib/systemd/system/postfix-resolvconf.service
/usr/lib/systemd/system/postfix.service
/usr/lib/systemd/system/postfix@.service
Since there's no cron jobs referring to it, disabling the service via systemctl disable --now postfix should do. If you want to be very strict mask it via systemctl mask --now postfix.
 
Last edited:
No, no purge. Just disable/mask the service and kill the remaining processes. You cannot remove your MTA, only replace it with another one. Or at least I don't know/remember how. A reboot is not necessary. If the process still eixst run pkill postfix showq. It should not be seen again.
 
Last edited:
Just apt install one of the other packages you saw above. Postfix will be replaced by that. For example
Bash: 
# apt install dma
The following package was automatically installed and is no longer required:
  libtlsrpt0
Use 'apt autoremove' to remove it.

Installing:
  dma

REMOVING:
  postfix

Summary:
  Upgrading: 0, Installing: 1, Removing: 1, Not Upgrading: 0
  Download size: 45.0 kB
  Freed space: 3,957 kB

Continue? [Y/n]
I'm not sure what calls that showq process. The service is masked, yeah? Be aware that this is kind of a workaround. It might make sense to investiagte why that process uses 100% CPU. I don't remeber ever seeing it though.
 
Last edited:
I have stopped and masked postfix. I have killed postfix and showq. I have installed dma (removed postfix). I have killed shoeq afgain. And, still, showq runs from user _chrony.

Most likely showq runs from
/var/spool/postfix/public
which also has the following binaries:
srw-rw-rw- 1 postfix postfix 0 Apr 20 12:56 cleanup
srw-rw-rw- 1 postfix postfix 0 Apr 20 12:56 flush
srw-rw-rw- 1 postfix postfix 0 Apr 20 12:56 pickup
srw-rw-rw- 1 postfix postfix 0 Apr 20 12:56 postlog
srw-rw-rw- 1 postfix postfix 0 Apr 20 12:56 qmgr
srw-rw-rw- 1 postfix postfix 0 Apr 20 12:56 showq
 
Last edited:
The file definitely comes from the postfix package and if you replace it with dma it should be gone too
With postfix installed
Bash: 
# dpkg -S /usr/lib/postfix/sbin/showq
postfix: /usr/lib/postfix/sbin/show
After installing dma, replacing it
Bash: 
# dpkg -S /usr/lib/postfix/sbin/showq
dpkg-query: no path found matching pattern /usr/lib/postfix/sbin/showq

# ls -l /usr/lib/postfix/sbin/showq
ls: cannot access '/usr/lib/postfix/sbin/showq': No such file or directory
What's this say?
Bash: 
ps aux | grep "[s]howq"
 
Last edited:
I cant disagree with you. I have rebooted the system and run 'find / -name showq' it returned nothing. But still showq is running !!!!
 
That's scary. I'd recommend updatedb and plocate to find things. It's very fast. Please share the output of the commands above.
 
Last edited:
pclocate cannot find showq.
As user _chrony I have still running many smtp instances, some smtpd instances some other smtp related instances (bounce, cleanup, error, etc) and one showq instance. I have the PID and navigated to the /proc/PID folder then what ?
 
Try something like this to get to know more about the process
Bash: 
tail -n+1 cmdline comm cgroup
ls -l cwd exe
cat environ | tr '\0' '\n'
htop and top can show most of that too, given they're configured for it, but above is a lot easier to share.
 
Last edited:
You must log in or register to reply here.
Top Bottom
Back