Since installing ASL on my Quad Core 8GB ram server on 17th of this month, I have noticed that when running TOP command in ssh, I have seen that the "nobody user", is racking up alot of processes and causing extreme server loads at time (hence the reason I am sitting all day watching TOP through SSH

Before ASL installation, there would be a small handful of nobody processes maybe using 0.1 to 0.3% CPU, now I am seeing nobody processes using 1-50% of cpu.

Going back through my logs, the high nobody issues started the same day when I installed ASL.

Is ASL using lots of memory?

ASL doesnt do anything as the user nobody. So those arent ASL commands. What commands do you see running exactly?

Hi Mike,

Over at configserver.com they say about gotroot when talking about mod sec and ASL.... "Care should be exercised with these rulesets as they can increase server resource usage by Apache child processes significantly". (www.configserver. com/cp/cmc.html)

So I think that puts some additional light on the subject.

The server is a quad core, 8gb ram server with 15k rpm drives in them so its not a tiny little server but is being overcome with nobody processes obviously brought on by ASL as these issues have only come about since installing ASL.

I am not sure what to do from here but I guess I will have to monitor the server fro the next few days and see how it goes.

I guess if it continues to be an issue, I will need to upgrade the server to hex core OR lose ASL.

No, your server specs are fine.

Are we talking about the full ASL here, not Lite and not using delayed rules?

The normal ruleset, as installed and enabled by default by the ASL installer, will add a significant load on your server and increase the memory footprint of apache quite a bit, but not in a way that would cause a constant 50% CPU usage, and these nobody processes are mysterious.

You can easily run ASL and the full mod_sec ruleset on a dual-core, 1Gb machine with 300+ sites (2Gb recommended IMHO).

Memory and CPU hogs -- the one that springs out at you when you run TOP, are generally clamd, which takes vast amounts of memory, especially with the safebrowsing rules enabled. Not apache.

I think we need to get to the bottom of your nobody processes. What are they running/doing?

Note that with a self-installed mod_sec + delayed rules, you need to manually tune things. Pretty much everything is enabled at once by default with that way of doing things, including RBLs that are best not enabled. But as I say, with the normal, full ASL + mod_sec, you get a sensible configuration out of the box.