Sophos User Bulletin Board has been retired and remains here for reference purposes only. Please use our Unified Threat Management forums on Sophos Community. See article 123010 for details.

Welcome to the Sophos User Bulletin Board.
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

LinkBack Thread Tools
kbr kbr is offline
part-time beta nurse
Join Date: Dec 2009
Location: Karlsruhe, Germany
Posts: 2,691
#11 (permalink)  
Old 11-29-2011, 03:58 PM

No, snort != webproxy. Snort is the thing behind IPS. Some of the smaller boxes start getting in trouble (ie swapping) if you run IPS and a lot of other services. Since this is not the case with your box, we can forget about this idea.

Just take a look at the logs around the time when you experienced the increase of the load and see if there are any error messges logged. You'll easily recognize them when you see them.
Improving reality for more than 30 years now...
Join Date: Oct 2006
Location: Karlsruhe
Posts: 877
#12 (permalink)  
Old 11-29-2011, 05:51 PM

Is the confd process still using 100% cpu process?
If yes, can you run a strace and post a few lines?

strace -p 7173
Join Date: Oct 2006
Location: Karlsruhe
Posts: 877
#13 (permalink)  
Old 11-30-2011, 01:29 PM

Problem was a looping confd process, triggered by a signal handling race condition.


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

All times are GMT. The time now is 03:58 PM.

Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2015, Jelsoft Enterprises Ltd.

These pages are specifically maintained for the discussion of firewall issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases.