PDA

View Full Version : rhgb process cpu usage



stopnowgo
30th May 2007, 04:59 PM
I setup two instances of snort to run after boot at runlevel5. They both are working flawlessly. However, since the setup was done I have a rhgb process running using a lot of my processor time, upwards of 92%. I am running fedora core 5 kernel 2.6.15-1.2054_FC5smp. I am logging into the box via ssh. Any thoughts or suggestions are appreciated.

brunson
30th May 2007, 06:21 PM
I forgot what rhgb was, so let me show you how I figured it out:


ebrunsonlx(~)$ man rhgb
No manual entry for rhgb
[status 1]
ebrunsonlx(~)$ which rhgb
/usr/bin/rhgb
ebrunsonlx(~)$ rpm -qf /usr/bin/rhgb
rhgb-0.16.4-3.fc6
ebrunsonlx(~)$ rpm -qi rhgb
Name : rhgb Relocations: (not relocatable)
Version : 0.16.4 Vendor: Red Hat, Inc.
Release : 3.fc6 Build Date: Wed 25 Oct 2006 09:46:57 PM MDT
Install Date: Tue 20 Feb 2007 03:20:01 AM MST Build Host: hs20-bc1-7.build.redhat.com
Group : System Environment/Base Source RPM: rhgb-0.16.4-3.fc6.src.rpm
Size : 374574 License: GPL
Signature : DSA/SHA1, Fri 03 Nov 2006 07:49:52 AM MST, Key ID b44269d04f2a6fd2
Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL : http://www.redhat.com/
Summary : Red Hat Graphical Boot
Description :
Red Hat Graphical Boot provides a clean and simple interface to the boot process

I would imagine (and I'm guessing) that your snort processes at boot time are not running in the background and is not allowing the entire boot process to complete, therefore the graphical boot is still running and sucking up resources.

stopnowgo
30th May 2007, 06:42 PM
I have set the two snort instances to run like below:

[root@snort1 rc5.d]# /sbin/chkconfig --list snortd
snortd 0:off 1:off 2:off 3:on 4:off 5:on 6:off
[root@snort1 rc5.d]# /sbin/chkconfig --list snortintd
snortintd 0:off 1:off 2:off 3:on 4:off 5:on 6:off


in both run levels they are set to priority 99 being the last thing started at each level. Should I have them start before another process or even in an earlier run level. I am not sure which service or runlevel would allow snort to start before or at some point in the boot process to allow the graphical boot to run correclty.

[root@snort1 rc5.d]# rpm -qi rhgb
Name : rhgb Relocations: (not relocatable)
Version : 0.16.3 Vendor: Red Hat, Inc.
Release : 1 Build Date: Wed 22 Feb 2006 12:17:27 PM CST
Install Date: Tue 23 Jan 2007 07:47:53 AM CST Build Host: hs20-bc1-3.build.redhat.com
Group : System Environment/Base Source RPM: rhgb-0.16.3-1.src.rpm
Size : 342718 License: GPL
Signature : DSA/SHA1, Mon 06 Mar 2006 04:30:00 PM CST, Key ID b44269d04f2a6fd2
Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL : http://www.redhat.com/
Summary : Red Hat Graphical Boot
Description :
Red Hat Graphical Boot provides a clean and simple interface to the boot process

brunson
30th May 2007, 06:49 PM
I reiterate that I'm guessing, and I could be wrong, but here's my logic:

Assumption: It used to work.
Given: You added snort.
Observed: The graphical boot no longer completes.
-------------
Conclusion: You broke it.

Try turning off snort, does it still happen? If not, your init scripts are wrong; if so, I am wrong and we need more information.

stopnowgo
30th May 2007, 08:51 PM
Thanks for the post. It was my init files. I recreated them and the rhgb no longer appears in the running process list. much appreciated.