My load average has skyrocketed and top shows that it’s one of the headless virtualbox virtual machines. But which one is it?
Doh! The culprit has the same RAM allocation as one of the others, that narrows it down, but doesn’t pinpoint the culprit.
So I used lsof to show all the open files and grep for the .vdi virtual hard disks (which hopefully like me, you’ve given a meaningful names to) to figure out which virtual machine is associated with which PID.
The result? The virus scanner on the windows guest had crashed.
Update: here’s an even easier method!
Simply add -c to the top command to show the command that was used to start the process. This will show the name of the VM as it was given to VBoxheadless as an argument.
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
5206 vmuser 20 0 6227004 4.225g 4.157g S 20.0 13.5 8114:58 /usr/lib/virtualbox/VBoxHeadless -s database
5407 vmuser 20 0 3832764 1.248g 1.212g S 13.3 4.0 5913:35 /usr/lib/virtualbox/VBoxHeadless -s squirrel
8393 vmuser 20 0 1965528 615628 554856 S 6.7 1.9 354:55.38 /usr/lib/virtualbox/VBoxHeadless -s automation