store | blogs | forums | twitter | facebook | wiki | downloads | support portal
Atomic Secure Linux
It is currently Wed Nov 26, 2014 9:43 am

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 39 posts ]  Go to page Previous  1, 2, 3
Author Message
 Post subject: Re: CPU useage increases occasionally after upgrade to 3.0
Unread postPosted: Wed Aug 31, 2011 6:47 pm 
Offline
Forum Regular
Forum Regular

Joined: Sat Dec 11, 2004 2:33 pm
Posts: 239
Location: South Africa
@mikeshinn

I read through the wikki & made changes to /var/ossec/etc/internal_options.conf

syscheck.sleep=5
syscheck.sleep_after=8

asl -s -f

CPU is down again

I will check all the monitored directories over the next few days.

_________________
Mark Brindley
2Large Networks - Web solutions that work


Top
 Profile  
 
 Post subject: Re: CPU useage increases occasionally after upgrade to 3.0
Unread postPosted: Thu Sep 01, 2011 9:38 am 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
User avatar

Joined: Thu Feb 07, 2008 7:49 pm
Posts: 3670
Location: Chantilly, VA
The bigger one is to look at what directories ASL is monitoring, and reporting for you. Thats where your CPU power is going to go.

Quote:
CPU is down again


Do you mean the CPU utilization is down, or the hardware itself is down (as in dead)?

_________________
Michael Shinn
Atomicorp - Security For Everyone

Co-Author of Troubleshooting Linux Firewalls.


Top
 Profile  
 
 Post subject: Re: CPU useage increases occasionally after upgrade to 3.0
Unread postPosted: Fri Sep 02, 2011 7:28 am 
Offline
Forum Regular
Forum Regular

Joined: Sat Dec 11, 2004 2:33 pm
Posts: 239
Location: South Africa
@mikeshinn -

Sorry that was a typo on my previous post - should read CPU USAGE is down again

However, since posting 1 Core is again sitting at 99%
I will be going through each monitored folder over the weekend to try and find out more.

Is there a tool or a way to SNIFF ossec-syscheckd to see exactly what it is doing?

_________________
Mark Brindley
2Large Networks - Web solutions that work


Top
 Profile  
 
 Post subject: Re: CPU useage increases occasionally after upgrade to 3.0
Unread postPosted: Fri Sep 02, 2011 9:29 am 
Offline
Long Time Forum Regular
Long Time Forum Regular

Joined: Sat Aug 20, 2005 9:30 am
Posts: 2812
Location: The Netherlands
strace

_________________
Lemonbit Internet Dedicated Server Management


Top
 Profile  
 
 Post subject: Re: CPU useage increases occasionally after upgrade to 3.0
Unread postPosted: Wed Oct 03, 2012 9:03 am 
Offline
New Forum User
New Forum User

Joined: Wed Oct 03, 2012 8:52 am
Posts: 1
Location: India
Hi,

As per Michael Shinn reply, i have checked the files and directories is configured to monitor for changes.It is in proper.

But still ossec-syscheckd consumes nearly 100 % cpu usage.Can u please tell me any other possibilities to fix this issue?

Regards,
Yesodha


Top
 Profile  
 
 Post subject: Re: CPU useage increases occasionally after upgrade to 3.0
Unread postPosted: Wed Oct 03, 2012 10:21 am 
Offline
Forum Regular
Forum Regular

Joined: Sat Dec 11, 2004 2:33 pm
Posts: 239
Location: South Africa
Last I was watching with strace and noticed that ossec was taking a long time to run go through /etc/dcc/log
What was interesting for me is that I have /etc/dcc/log on the Ignore list.

Another thing I noticed is alot of -1 ENOENT (No such file or directory) notices.

stat("/var/ossec/queue/ossec/.wait", 0x7dd0196e80c0) = -1 ENOENT (No such file or directory)

is that normal?

_________________
Mark Brindley
2Large Networks - Web solutions that work


Top
 Profile  
 
 Post subject: Re: CPU useage increases occasionally after upgrade to 3.0
Unread postPosted: Wed Oct 03, 2012 4:48 pm 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
User avatar

Joined: Thu Feb 07, 2008 7:49 pm
Posts: 3670
Location: Chantilly, VA
That depends on the process, which ossec process was doing this?

_________________
Michael Shinn
Atomicorp - Security For Everyone

Co-Author of Troubleshooting Linux Firewalls.


Top
 Profile  
 
 Post subject: Re: CPU useage increases occasionally after upgrade to 3.0
Unread postPosted: Wed Oct 03, 2012 5:05 pm 
Offline
Forum Regular
Forum Regular

Joined: Sat Dec 11, 2004 2:33 pm
Posts: 239
Location: South Africa
mikeshinn wrote:
That depends on the process, which ossec process was doing this?


It was/is ossec-syscheckd

_________________
Mark Brindley
2Large Networks - Web solutions that work


Top
 Profile  
 
 Post subject: Re: CPU useage increases occasionally after upgrade to 3.0
Unread postPosted: Thu Oct 04, 2012 12:20 pm 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin

Joined: Wed Dec 31, 1969 8:00 pm
Posts: 7957
Location: earth
thats what checks for file system changes


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 39 posts ]  Go to page Previous  1, 2, 3

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Yahoo [Bot] and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group