Re: Prelude-LML 100%CPU usage after ~3-5 minutes post startup

Hi Tim,

Le lundi 23 novembre 2009 à 17:21 +1100, Tim Arneaud a écrit :
> I'm wondering if anyone else is experiencing this behavior and/or has a
> pointer for me to check.
> 
> As the subject states, I'm running a fairly default installation of
> Prelude-LML that maxes out the CPU about 3-5 minutes after daemon
> startup. 
> 
> Prelude-lml successfully registers with the Manager and events do appear
> to be updating the database prior to hitting %100 utilization. 
> 
> However after a few minutes it becomes completely unresponsive and also
> is shown as offline via Manager/Prewikka.
> 
> There don't appear to be instances of others seeing this behavior (via
> google and list searches) that I can find.
> 
> However I've duplicated this on two separate systems (Ubuntu/Debian)
> with minimal configuration (per the documentation) and am surprised that
> others are not seeing this.
> 
> *Prior* to maxing 100% CPU, my /var/log/messages logfile shows relevant
> entries ->

[...]

> Others clearly have this working so I'm at a loss as to how my fairly
> basic/default configuration would require significant python library
> dependency changes.
> 
> *- Is anyone else experiencing this?
> *- Can anyone point me in a new direction that I should look at?

Are you able to easily reproduce this problem ?

Could you install prelude-lml/libprelude debugging packages, and next
time the issue reproduce, perform the following operation:

- Run strace -p <pid of lml process>, and provides us the output

- Run gdb, the following way:

$ gdb
  attach <pid of lml process>
  [hit control-c]
  bt


And provides us with the output as well as the size of your currently
monitored logs files ?

Additionally, could you try reproducing the issue by starting
Prelude-LML using the following options:

$ prelude-lml --metadata=head,nowrite --dry-run


Regards,

-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                       Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com


_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user