The strange case of the notebook fan that would started spinning after a few hours

Problem

A problem started to happen last week with my Dell notebook running Windows 10. After I kept it open for a few hours, its fan would start spinning noisily and never stop. This started to happen without a fail every day. The only brute force solution that worked was to restart Windows. That would keep the fans silent for a few hours before they would start all over again.

Investigation

From the minimized Task Manager CPU graph I could see that all 8 logical CPU cores seem to have been engaged 100 percent by some process. Opening Task Manager to watch what process was causing this was a dead end because Task Manager window would freeze when restored. In the end, I had to try the same with Process Explorer and leave its window open to catch the rogue service: WmiPrvSE.exe.

Looking into this service turned out to be a dead end. It did not lead to any suitable culprit and it was not clear why this service was going all hammer and tongs on the cores.

I then looked at the problem from a different angle: this problem was new. What had changed on my Windows recently? I had installed the 1809 update for its WSL feature. And after that I had switched over from Cygwin to Ubuntu 18.04 running on WSL. And indeed the problem seemed to only occur when I had Ubuntu open for a few hours.

The next time this happened, I tried htop in Ubuntu. Just like Task Manager and Process Explorer, htop too hung. But I left it open nevertheless and after a while it showed that there were hundreds of wget and timeout 1 wget commands taking over all the cores! Who was running this automatically after a few hours in Ubuntu?

Using Google helped to reveal a new suspect: byobu. This is the terminal multiplexer that I use in Ubuntu. Checking its source code confirmed that it was using wget commands to get the host IP address (don’t ask me why!). I am guessing it does it periodically to keep its IP address updated. And this simple lookup was somehow acting like a virus outburst after a few hours. Why?

It turns out that WSL has a serious bug: if you open a large number of non-blocking TCP connections its ephemeral ports are exhausted. I guess the byobu’s regular requests, when performed over a span of hours, exhausted this. And after that the LxssManager service, which is the layer that enables ELF executables to be executed on Windows, would go crazy. The only solution at this point: restart LxssManager.

Solution

So the solution is: if possible do not use Byobu on Ubuntu WSL. If you get this problem, then restart LxssManager by opening a CMD window with Administrator privilege and running these commands:

sc stop LxssManager
sc start LxssManager

Note that stopping the LxssManager service kills Ubuntu.