Re: Prelude-LML 100%CPU usage after ~3-5 minutes post startup

Yoann Vandoorselaere <[email protected]> Mon, 07 Dec 2009 10:16:25 +0100
Newsgroups gmane.comp.security.ids.prelude.user
Message-ID <1260177385.1952.299.camel@arwen>
Hi Tim,

Le lundi 07 décembre 2009 à 11:09 +1100, Tim Arneaud a écrit :
> I was able to test this further with different operating systems and
> different versions of the Prelude-lml - and it would appear that the
> flaw lies in the Ubuntu Package for Prelude-lml 0.9.14 under Karmic
> (9.10) 
> 
> LML versions 0.9.12.2 (also package version  for Ubuntu 9.04), 0.9.14
> and 0.9.15 (package version for RHE5) compiled and ran successfully
> under the same operating system without CPU spike/file polling.
> LML 0.9.14 runs fine under Ubuntu 9.04 (Jaunty).
> 
> If you wish for me to join #prelude and still troubleshoot with you
> then I will do so, however seeing as the same version (0.9.14) works
> when compiled from prelude-ids.com in the same operating systems, it
> would seem that the LML code/release is correct. I see this as a
> Ubuntu package management issue for Karmic, not a Prelude issue. At
> this stage I do not know how the package is being modified between
> Prelude-IDS and the Karmic tree.

My guess is that there is a compatibility problem between the shipped
libev version, and the Kernel used. I also got one report of a person
who could reproduce the problem (although not reliably) under Debian.

If you could take some time and come to #prelude so that we can see if
we can workaround/fixes the issue on our side, it would be very nice!

Thanks,

-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                       Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com


_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user