[Prelude Hybrid IDS] #183: Prewikka CPU load unusually high while viewing certain events
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#183: Prewikka CPU load unusually high while viewing certain events
----------------------+-----------------------------------------------------
Reporter: grgomez | Owner: yoann
Type: defect | Status: new
Priority: normal | Milestone:
Component: prewikka | Version: 0.9
Severity: normal | Keywords:
----------------------+-----------------------------------------------------
Prewikka CPU utilization goes abnormally high when trying to view specific
types of events. For example, attemptin to view this in Prewikka (inline
filters set to organize by classification only):
120 x SMTP Content-Transfer-Encoding overflow attempt
Prewikka does this on the host (output from top):
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
32728 apache 25 0 14056 8420 3612 R 99 0.7 0:27.75 prewikka.cgi
Eventually this results in a 500 error from Apache. Prewikka does not do
this for events outside of a pattern that includes the text "SMTP" and a
few "-" characters.
--
Ticket URL: <https://trac.prelude-ids.org/ticket/183>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel