Mailinglist Archive: opensuse-security (34 mails)

< Previous Next >
Re: [opensuse-security] mandb is possibly compromised
  • From: Dan Goodman <Dan.Goodman@xxxxxxxx>
  • Date: Mon, 27 Oct 2008 10:59:41 -0400
  • Message-id: <4905D75D.1050406@xxxxxxxx>
Carlos E. R. wrote:


El 2008-10-24 a las 17:49 -0700, Clint Moffatt escribió:

Please, remember to reply to the list, not in private.

Hi Carlos,

Thanks for the prompt reply. I thought the mandb was causing the
system freeze, as it was using 40% CPU and rising when it freezes. If
I did not kill it last time, then it would have probably caused it to
freeze again. Powering off is the only thing I can do to get it back
once it has completely frozen. I hope this gives more information as
to what is happening.

Well, you may have a problem, but not a security one, I think. That being
so, you may get more replies in the standard mail list.

There are a series of processes that run every day, about the same hour,
and one of them is this mandb. Some of these processes are disk-intensive
(like locatedb), and in some cases can slow your system dramatically. Not
crash the system, but slow it down: specially if the disk is big and slow,
and memory is scarce.

The mandb process should not be problematic. Maybe you can help it by
deleting some files, maybe /var/cache/man/, but of this I'm not sure. You
can make a backup of that entire directory path, delete the files (not
directories), and wait for changes.

But first look at the logs for clues.

I have observed apparent "frozen state" on occasion, as well, most
typically when Kerry Beagle runs in the background.

Besides finding a way to set such processes (or the ones listed by the
originator of the thread) to a lower priority, I have found some
apparent partial relief (system appears slow, not frozen) by
experimenting with the swappiness parameter.

To do so for the current session, as root execute:

# echo "N" > /proc/sys/vm/swappiness

where N is an integer between 0 and 100.

For persistence across reboot, edit the file /etc/sysctl.conf (again as
root or with sudo).

Change or add the line for swappiness:

vm.swappiness = N

again where N is an integer between 0 and 100.. I believe default is 60
in openSUSE 10.3, and higher values of N are a greater tendency to allow
swapping.

It is a subject that has been open to debate by members of the Linux
community with more experience than I have in such matters. Some believe
that the default is right, some believe all you can get is better, and
some believe that the least amount necessary gives the best performance.
Even some kernel developer types seem to not be in full agreement.

I ended up just experimenting. Currently I have it set persistently to 0
and it seems to give better interactive performance. I did experiment
with 100 and wasn't impressed with those results. YMMV.

--
Dan Goodman
Senior Systems Administrator
Burlington Coat Factory Warehouse

Dan dot Goodman @t coat dot. com
(because I believe most address harvesters know how to sed " dot " ->
"." and " at " ->"@")


--
To unsubscribe, e-mail: opensuse-security+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-security+help@xxxxxxxxxxxx

< Previous Next >
Follow Ups