Has anyone else seen output from 'ps -faxwl' like this:
1 0 6366 1 16 0 2236 536 schedu S ? 0:00 crond 1 0 16115 6366 16 0 5456 1256 do_for D ? 0:00 \_ CROND 5 0 16116 16115 16 0 5456 1256 coredu D ? 0:00 | \_ CROND 1 0 16119 6366 17 0 5456 1256 do_for D ? 0:00 \_ CROND 5 0 16120 16119 17 0 5456 1256 coredu D ? 0:00 | \_ CROND 1 0 16123 6366 17 0 5456 1256 do_for D ? 0:00 \_ CROND 5 0 16124 16123 17 0 5456 1256 coredu D ? 0:00 | \_ CROND
I've deleted several additional lines. The load average on this system is 30 as I write this. Notice that the second of each pair of jobs seems to be in the process of doing a core dump, which is why they are unkillable.
When I first saw these on a server, I thought some hacker had broken in and built a pretty high firewall with Firewall Builder (highly recommended, btw). But now I see it on a workstation, and so it looks like a cron bug. The workstation from which the above comes has no user crontabs, just the stuff in /etc/cron.* which goes in from a standard Fedora "Developer's Workstation" install.