[BlueOnyx:18164] Re: Dfix grep processes

[Greg Kuhnert]

Hi all.

The most common underlying root cause here in my experience is problems with your CODB database, or some pretty heavy attacks from a large list of IP's (or both). Changing the cron interval will help keep you alive, but what is the real reason behind the problem? 

for X in `cat $TLOGCURRENT | grep -vf $TLOGIP`;

This is the line in question. TLOGIP is the list of already existing blacklisted IP’s. (the dfix-badip-*.txt files). If those files are really big, it can cause the size of the badip file to be very big. If that is the case, the grep -vf might cause you some grief. Suggest changing it from grep to fgrep in that line to see if that helps.

GK

> On 17 Aug 2015, at 5:17 pm, Steffan Noord <mailinglist at tikklik.nl> wrote:
> 
> Had the same isue
> I change the cron interval in /etc/cron.d/dfix
> Afther that no problems anymore
> 
> Steffan
> 
> 
> -----Oorspronkelijk bericht-----
> Van: blueonyx-bounces at mail.blueonyx.it
> [mailto:blueonyx-bounces at mail.blueonyx.it] Namens Robert Fitzpatrick
> Verzonden: zondag 16 augustus 2015 19:55
> Aan: BlueOnyx General Mailing List
> Onderwerp: [BlueOnyx:18162] Dfix grep processes
> 
> I still have a 5106R up and lately it has been experiencing an issue with
> lots of grep processes like below building up and causing load issues....
> 
> [root at webtent server_backup]# ps ax | grep grep
>  6013 ?        R      1:45 grep -vf /tmp/dfix-badip-5065.txt
>  6944 ?        R      1:23 grep -vf /tmp/dfix-badip-6156.txt
>  7739 ?        R      1:03 grep -vf /tmp/dfix-badip-6949.txt
>  8534 ?        R      0:47 grep -vf /tmp/dfix-badip-7745.txt
>  9351 ?        R      0:34 grep -vf /tmp/dfix-badip-8541.txt
> 10204 ?        R      0:24 grep -vf /tmp/dfix-badip-9360.txt
> 11030 ?        R      0:17 grep -vf /tmp/dfix-badip-10222.txt
> 11851 ?        R      0:11 grep -vf /tmp/dfix-badip-11049.txt
> 12758 ?        R      0:03 grep -vf /tmp/dfix-badip-11955.txt
> 
> Has anyone seen this issue? The only way I can get the server back to normal
> load is killall grep.
> 
> Thanks,
> Robert
> 
> _______________________________________________
> Blueonyx mailing list
> Blueonyx at mail.blueonyx.it
> http://mail.blueonyx.it/mailman/listinfo/blueonyx
> 
> _______________________________________________
> Blueonyx mailing list
> Blueonyx at mail.blueonyx.it
> http://mail.blueonyx.it/mailman/listinfo/blueonyx

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.blueonyx.it/pipermail/blueonyx/attachments/20150818/102d8dd3/attachment.html>