Re: Prelude-LML 100%CPU usage after ~3-5 minutes post startup

Yoann Vandoorselaere <[email protected]> Tue, 01 Dec 2009 13:39:33 +0100
Newsgroups gmane.comp.security.ids.prelude.user
Message-ID <1259671174.11727.4.camel@arwen>
Hi Tim,

Le vendredi 27 novembre 2009 à 17:03 +1100, Tim Arneaud a écrit :
> Thanks for the feedback!
> 
> Using a fairly basic installation of Karmic Ubuntu 9.10 as well as a
> very basic installation of prelude-lml I'm able to duplicate
> (triplicate) this high cpu load situation. Thanks to the earlier
> e-mails, I established that the error in prewikka was related to the
> redundancy of md5 function being called in prewikka and
> post-python2.5.
> -> which updated the apache2/error.log
> -> which then cycled into un-standardized errors in prelude-lml
> A Red-herring for my cpu issue, but an issue in the prewikka package
> for Ubuntu nonetheless.
> 
> The CPU still spikes to 100% at any updates of any of the logfiles
> analyzed by prelude-lml. An "su -" whether successful or failed,
> updates /var/log/auth.log - the instant a logfile is updated, the loss
> of control of prelude-lm occurs.
> 
> In a freshly installed VM, the logfiles are very small and the
> prelude-lml has the apache configuration removed. Although I can see
> the advantages suggested of using sockets over files, not using
> sockets does not appear to be causing troubles for others - especially
> with effectively a default installation.
> 
> Starting prelude-lml with the metadata and dry-run flags also results
> in the same behavior.
> prelude-lml --metadata=head,nowrite --dry-run
> 
> Below, I've included the suggestions/outputs from Yoann (I could not
> locate a specific prelude-lml debug package however, 
> but did utilize libprelude2-dbg...). 
> 
> Any feedback or suggestions are appreciated. 

Could you come to irc.freenode.net, #prelude, so that we can have an
interactive look at the problem and debug the issue ?

Regards,

-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                       Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com


_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user