Auditd cause high CPU and high Load

[Minh Tien Nguyen]

He Steve Grubb.

Nice to heard from you. Thank you so much for your help. We will try to set
that config and see the result.

Thanks & best regards.

On Thu, Dec 1, 2016 at 9:57 PM, Steve Grubb <sgrubb at redhat.com> wrote:

> Hello,
>
> On Thursday, December 1, 2016 11:59:47 AM EST Minh Tien Nguyen wrote:
> > My name is Nguyen Minh Tien. I came from Singapore. I am working as a
> > developer for Garena LTD. Last week, I met a problem with Audit on our
> > product servers. The Auditd process had caused of some pick time on our
> > server. In that times, system CPU cost a lot, around 100%. And the Load
> > average is over 30. We have tried to find the root cause and have failed.
> > Could you help us for that case?
> >
> > The servers, which meet the performance issue, use Redhat 6.8 and their
> > kernel is 2.6.32.
>
> You might want to check the flush setting for /etc/audit/auditd.conf. I
> would
> recommend using incremental and set the freq to something like 200 or 500.
> Using sync or data will kill performance, but the event is written to disk
> before processing the next event.
>
> -Steve
>



-- 
Best regards
_________________________
Nguyen Minh Tien - SA Team
email: nguyenmt at garena.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20161201/878aea2d/attachment.htm>