Prelude-LML 100%CPU usage after ~3-5 minutes post startup

Tim Arneaud <[email protected]> Mon, 23 Nov 2009 17:21:16 +1100
Newsgroups gmane.comp.security.ids.prelude.user
Message-ID <50459D7B38B38E40A724F3DC7239A35D0633F4DB@IS-EX-BEV3.unimelb.edu.au>
Hi All,
I'm wondering if anyone else is experiencing this behavior and/or has a
pointer for me to check.

As the subject states, I'm running a fairly default installation of
Prelude-LML that maxes out the CPU about 3-5 minutes after daemon
startup. 

Prelude-lml successfully registers with the Manager and events do appear
to be updating the database prior to hitting %100 utilization. 

However after a few minutes it becomes completely unresponsive and also
is shown as offline via Manager/Prewikka.

There don't appear to be instances of others seeing this behavior (via
google and list searches) that I can find.

However I've duplicated this on two separate systems (Ubuntu/Debian)
with minimal configuration (per the documentation) and am surprised that
others are not seeing this.

*Prior* to maxing 100% CPU, my /var/log/messages logfile shows relevant
entries ->

Nov 23 17:04:35 host prelude-lml: WARNING: no appropriate format defined
for log entry: '  File "/usr/share/prewikka/cgi-bin/prewikka.cgi", line
83, in <module>'.
Nov 23 17:04:35 host prelude-lml: WARNING: no appropriate format defined
for log entry: '    request.init()'.
Nov 23 17:04:35 host prelude-lml: WARNING: no appropriate format defined
for log entry: '  File "/usr/lib/python2.6/cgi.py", line 583, in keys'.
Nov 23 17:04:35 host prelude-lml: WARNING: no appropriate format defined
for log entry: '    raise TypeError, "not indexable"'.
Nov 23 17:04:35 host prelude-lml: WARNING: no appropriate format defined
for log entry: 'TypeError: not indexable'.

Others clearly have this working so I'm at a loss as to how my fairly
basic/default configuration would require significant python library
dependency changes.

*- Is anyone else experiencing this?
*- Can anyone point me in a new direction that I should look at?

Any information or pointers are most welcome, as I'm very keen to get
this working and giving Prelude a full run :D

Thanks in advance!

Kind Regards,
Tim Arneaud
The University of Melbourne, Carlton
Victoria 3053, Australia


_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user