Re: [Prelude Hybrid IDS] #248: prelude-manager crash
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#248: prelude-manager crash ---------------------------------+------------------------------------------ Reporter: [email protected] | Owner: yoann Type: defect | Status: assigned Priority: high | Milestone: Component: prelude-manager | Version: 0.9 Severity: critical | Resolution: Keywords: | ---------------------------------+------------------------------------------ Comment (by [email protected]): I did some testing and I found this was caused by the default setting in ulimit -n of 1024. the fix is to increase the nofile setting in /etc/security/limits.conf {{{ * - nofile 4096 }}} I will add this to the prelude-managet trouble shooting page latter tonight To clarify what happened it seems like the prelude manager creates 3 fifos for each sensor that attaches to it (400 sensors * 3 fifos = 1200 files). The person who installed the prelude-manager on this host (not me) configured it to run as root rather than its own user. when the prelude- manager excided the maximum number of open files for the user it caused several other processs running as root to hang. The system lock out until a reboot was a side effect caused by an other process not being able to open files. -- Ticket URL: <https://trac.prelude-ids.org/ticket/248#comment:2> Prelude Hybrid IDS <http://www.prelude-ids.org> The Prelude Hybrid Intrusion Detection System suite _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel