[BlueOnyx:06716] Re: [bluequartz] Re: cced gone wild

[Greg Kuhnert]

Hi Abdul...

On 17/03/2011 3:21 PM, Abdul Rashid Abdullah wrote:
> Did the /tmp check already earlier as well.  Ps aux doesn't turn up anything
> unusual nor any /usr/local/httpd processes
>
> The biggest thing I see is that if I let the /etc/cron.d/dfix.cron run, then
> it quickly contributes to several cced processes spawning in a short period.
> Whereas, if I prevent the cron job from running, kill the secondary cced
> processes, it appears to run without any spawning of these processes keeping
> the cpu down.

Turning off dfix may reduce the number of log messages going to your 
screen, but it will not fix the underlying problem. All DFIX is doing is 
asking for information from CCED.

You can disable some code in DFIX to help reduce the symptoms you are 
experiencing, but there is still an underlying problem on your server 
that needs to be addressed. If I were to take a guess, I think some data 
in CCED may be corrupt on your box. See my post 
http://www.blueonyx.it/pipermail/blueonyx/2011-February/006533.html for 
instructions that will show you how to audit some of the CCED database 
information.

See below for the lines in dfix that you can comment out until you fix 
the cced problem.

Regards,
Greg.

# Pam_abl blocks
   touch $FAILOBJECTS
   for FAILOBJECT in `echo 'find fail_hosts blocking = "1"' | 
/usr/sausalito/bin/cceclient | grep ^104 | cut -d " " -f 3`
   do
     echo get $FAILOBJECT > $FAILOBJECTS
   done
   cat $FAILOBJECTS | /usr/sausalito/bin/cceclient | grep ^102.*host_ip 
| cut -d \" -f 2 > $MUSTBLOCK
   rm $FAILOBJECTS