Re: Prelude-LML 100%CPU usage after ~3-5 minutes post startup

Hi Yoann,

I was able to test this further with different operating systems and different versions of the Prelude-lml - and it would appear that the flaw lies in the Ubuntu Package for Prelude-lml 0.9.14 under Karmic (9.10) 

LML versions 0.9.12.2 (also package version  for Ubuntu 9.04), 0.9.14 and 0.9.15 (package version for RHE5) compiled and ran successfully under the same operating system without CPU spike/file polling.
LML 0.9.14 runs fine under Ubuntu 9.04 (Jaunty).

If you wish for me to join #prelude and still troubleshoot with you then I will do so, however seeing as the same version (0.9.14) works when compiled from prelude-ids.com in the same operating systems, it would seem that the LML code/release is correct. I see this as a Ubuntu package management issue for Karmic, not a Prelude issue. At this stage I do not know how the package is being modified between Prelude-IDS and the Karmic tree.

Thanks very much for your help and feedback guys. I'm up and running happily now!

Kind Regards,
Tim Arneaud
The University of Melbourne, Carlton

-----Original Message-----
From: Yoann Vandoorselaere [mailto:[email protected]] 
Sent: Tuesday, December 01, 2009 11:40 PM
To: Tim Arneaud
Cc: [email protected]
Subject: Re: [prelude-user] Prelude-LML 100%CPU usage after ~3-5 minutes post startup

Hi Tim,

Le vendredi 27 novembre 2009 à 17:03 +1100, Tim Arneaud a écrit :
> Thanks for the feedback!
> 
> Using a fairly basic installation of Karmic Ubuntu 9.10 as well as a
> very basic installation of prelude-lml I'm able to duplicate
> (triplicate) this high cpu load situation. Thanks to the earlier
> e-mails, I established that the error in prewikka was related to the
> redundancy of md5 function being called in prewikka and
> post-python2.5.
> -> which updated the apache2/error.log
> -> which then cycled into un-standardized errors in prelude-lml
> A Red-herring for my cpu issue, but an issue in the prewikka package
> for Ubuntu nonetheless.
> 
> The CPU still spikes to 100% at any updates of any of the logfiles
> analyzed by prelude-lml. An "su -" whether successful or failed,
> updates /var/log/auth.log - the instant a logfile is updated, the loss
> of control of prelude-lm occurs.
> 
> In a freshly installed VM, the logfiles are very small and the
> prelude-lml has the apache configuration removed. Although I can see
> the advantages suggested of using sockets over files, not using
> sockets does not appear to be causing troubles for others - especially
> with effectively a default installation.
> 
> Starting prelude-lml with the metadata and dry-run flags also results
> in the same behavior.
> prelude-lml --metadata=head,nowrite --dry-run
> 
> Below, I've included the suggestions/outputs from Yoann (I could not
> locate a specific prelude-lml debug package however, 
> but did utilize libprelude2-dbg...). 
> 
> Any feedback or suggestions are appreciated. 

Could you come to irc.freenode.net, #prelude, so that we can have an
interactive look at the problem and debug the issue ?

Regards,

-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                       Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com


_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user