cif-router at 100% on one core -- remains after restart - cif client delays.

After installing CIFv3 (release: 3.0.0a16.tar.gz), I noticed that the CPU usage on one of the cores is 100% all the time (from the cif-router processes) and so far it has been for > 24 hours.

1542 cif       20   0  232456  54220   7668 R 100.0  0.3 723:11.87 cif-router                                                                                                     
 1292 cif       20   0  563632  42904  10104 S   0.3  0.3   0:09.22 cif-httpd                                                                                                      
 1546 cif       20   0  346896  32972   6560 S   0.3  0.2   4:01.03 cif-router                                                                                                     
    1 root      20   0  185488   6084   3948 S   0.0  0.0   0:02.18 systemd                   

Yesterday there were multiple cif-router’s and the rest were < 1%, while one was at 100%. This is even after stopping/restarting/etc, and even rebooting the system.

For the stop+start, I am using this order (not sure if it matters?):

# service cif-httpd stop
# service cif-router stop
r# service csirtg-smrt stop

# service cif-router start
# service cif-httpd start
# service csirtg-smrt start

After you stop, it’s fine for a few minutes, and then the same thing happens.

2017-02-24 16:42:24,676 - INFO - cifsdk.client.client[119][MainThread] - running ping
roundtrip: 0.0105819702148 ms
roundtrip: 0.0045919418335 ms
roundtrip: 0.00449109077454 ms
roundtrip: 0.00470805168152 ms

After less than a minute, same thing:

4274 cif       20   0  227836  50136   7560 R  97.7  0.3   0:15.41 cif-router  

and response times start to hang again:

2017-02-24 16:44:19,802 - INFO - cifsdk.client.client[119][MainThread] - running ping
roundtrip: 13.75141716 ms
...hangs...

By hangs/delays, I mean this:

$ cif -p

2017-02-24 16:30:21,358 - INFO - cifsdk.client.client[119][MainThread] - running ping
...hangs...
roundtrip: 66.7338149548 ms
...hangs...

Not sure what’s causing this.

It’s running on an AWS VM.

Possibly related, yesterday I was running tcpdump, and I saw massive amounts of DNS traffic, but I am assuming this is related to the list ingestion. At this point, I am not seeing any new DNS traffic, but the process is still at 100%.

The last bit, noticed this before I killed the process the last time:

cif       1272  0.0  0.2  94212 37008 ?        Ss   04:17   0:00 /usr/bin/python /usr/local/bin/csirtg-smrt --remember --service --client cif --service --fireball --delay 2
cif       1753  0.5  1.0 235328 165020 ?       S    04:19   3:45 /usr/bin/python /usr/local/bin/csirtg-smrt --remember --service --client cif --service --fireball --delay 2
cif       3917  0.0  0.0      0     0 ?        Z    16:19   0:00 [csirtg-smrt] <defunct>

Not sure if there should be multiple and one being defunct?

Thanks.

[ventz]

Yea just replied there with my errors.

On Fri, Feb 24, 2017 at 12:29 PM, Wes [e-mail] wrote:

did you see any of these errors:

csirtgadgets/csirtg-smrt-py#157 https://github.com/csirtgadgets/csirtg-smrt-py/issues/157

?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/csirtgadgets/bearded-avenger/issues/263#issuecomment-282351750, or mute the thread https://github.com/notifications/unsubscribe-auth/AA3AMC1qm15ZCVVVT3yZKzzMesx9sRorks5rfxNxgaJpZM4MLd0c .

– -Ventz http://vpetkov.net

[wesyoung]

released a17, should solve most of these issues. gonna close this for now, re-open new issues as the come up… (ty for the feedback!)