store | blogs | forums | twitter | facebook | wiki | mailing lists | downloads | support portal
Atomic Secure Linux
It is currently Sat Apr 19, 2014 8:39 pm

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 4 posts ] 
Author Message
 Post subject: nobody processes in conjunction with asl causing server load
Unread postPosted: Mon Feb 27, 2012 5:08 pm 
Offline
Forum User
Forum User

Joined: Fri Feb 17, 2012 3:37 am
Posts: 24
Location: Spain
Since installing ASL on my Quad Core 8GB ram server on 17th of this month, I have noticed that when running TOP command in ssh, I have seen that the "nobody user", is racking up alot of processes and causing extreme server loads at time (hence the reason I am sitting all day watching TOP through SSH

Before ASL installation, there would be a small handful of nobody processes maybe using 0.1 to 0.3% CPU, now I am seeing nobody processes using 1-50% of cpu.

Going back through my logs, the high nobody issues started the same day when I installed ASL.

Is ASL using lots of memory?


Top
 Profile  
 
 Post subject: Re: nobody processes in conjunction with asl causing server
Unread postPosted: Mon Feb 27, 2012 5:53 pm 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
User avatar

Joined: Thu Feb 07, 2008 7:49 pm
Posts: 3548
Location: Chantilly, VA
ASL doesnt do anything as the user nobody. So those arent ASL commands. What commands do you see running exactly?

_________________
Michael Shinn
Atomicorp - Security For Everyone

Co-Author of Troubleshooting Linux Firewalls.


Top
 Profile  
 
 Post subject: Re: nobody processes in conjunction with asl causing server
Unread postPosted: Tue Feb 28, 2012 5:12 am 
Offline
Forum User
Forum User

Joined: Fri Feb 17, 2012 3:37 am
Posts: 24
Location: Spain
Hi Mike,

Over at configserver.com they say about gotroot when talking about mod sec and ASL.... "Care should be exercised with these rulesets as they can increase server resource usage by Apache child processes significantly". (www.configserver. com/cp/cmc.html)

So I think that puts some additional light on the subject.

The server is a quad core, 8gb ram server with 15k rpm drives in them so its not a tiny little server but is being overcome with nobody processes obviously brought on by ASL as these issues have only come about since installing ASL.

I am not sure what to do from here but I guess I will have to monitor the server fro the next few days and see how it goes.

I guess if it continues to be an issue, I will need to upgrade the server to hex core OR lose ASL.


Top
 Profile  
 
 Post subject: Re: nobody processes in conjunction with asl causing server
Unread postPosted: Tue Feb 28, 2012 8:55 am 
Offline
Long Time Forum Regular
Long Time Forum Regular

Joined: Thu Dec 09, 2004 11:19 am
Posts: 2007
No, your server specs are fine.

Are we talking about the full ASL here, not Lite and not using delayed rules?

The normal ruleset, as installed and enabled by default by the ASL installer, will add a significant load on your server and increase the memory footprint of apache quite a bit, but not in a way that would cause a constant 50% CPU usage, and these nobody processes are mysterious.

You can easily run ASL and the full mod_sec ruleset on a dual-core, 1Gb machine with 300+ sites (2Gb recommended IMHO).

Memory and CPU hogs -- the one that springs out at you when you run TOP, are generally clamd, which takes vast amounts of memory, especially with the safebrowsing rules enabled. Not apache.

I think we need to get to the bottom of your nobody processes. What are they running/doing?

Note that with a self-installed mod_sec + delayed rules, you need to manually tune things. Pretty much everything is enabled at once by default with that way of doing things, including RBLs that are best not enabled. But as I say, with the normal, full ASL + mod_sec, you get a sensible configuration out of the box.

_________________
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 4 posts ] 

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group