CPU useage increases occasionally after upgrade to 3.0

kram · **Posted:** Wed Aug 31, 2011 6:47 pm

@mikeshinn

I read through the wikki & made changes to /var/ossec/etc/internal_options.conf

syscheck.sleep=5
syscheck.sleep_after=8

asl -s -f

CPU is down again

I will check all the monitored directories over the next few days.

mikeshinn · **Posted:** Thu Sep 01, 2011 9:38 am

The bigger one is to look at what directories ASL is monitoring, and reporting for you. Thats where your CPU power is going to go.

Quote:

CPU is down again

Do you mean the CPU utilization is down, or the hardware itself is down (as in dead)?

kram · **Posted:** Fri Sep 02, 2011 7:28 am

@mikeshinn -

Sorry that was a typo on my previous post - should read CPU USAGE is down again

However, since posting 1 Core is again sitting at 99%
I will be going through each monitored folder over the weekend to try and find out more.

Is there a tool or a way to SNIFF ossec-syscheckd to see exactly what it is doing?

breun · **Posted:** Fri Sep 02, 2011 9:29 am

strace

yesodha · **Posted:** Wed Oct 03, 2012 9:03 am

Hi,

As per Michael Shinn reply, i have checked the files and directories is configured to monitor for changes.It is in proper.

But still ossec-syscheckd consumes nearly 100 % cpu usage.Can u please tell me any other possibilities to fix this issue?

Regards,
Yesodha

kram · **Posted:** Wed Oct 03, 2012 10:21 am

Last I was watching with strace and noticed that ossec was taking a long time to run go through /etc/dcc/log
What was interesting for me is that I have /etc/dcc/log on the Ignore list.

Another thing I noticed is alot of -1 ENOENT (No such file or directory) notices.

stat("/var/ossec/queue/ossec/.wait", 0x7dd0196e80c0) = -1 ENOENT (No such file or directory)

is that normal?

mikeshinn · **Posted:** Wed Oct 03, 2012 4:48 pm

That depends on the process, which ossec process was doing this?

kram · **Posted:** Wed Oct 03, 2012 5:05 pm

mikeshinn wrote:

That depends on the process, which ossec process was doing this?

It was/is ossec-syscheckd

scott · **Posted:** Thu Oct 04, 2012 12:20 pm

thats what checks for file system changes

CPU useage increases occasionally after upgrade to 3.0

Who is online