The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

BFD High Load

Discussion in 'General Discussion' started by BettyLu, Feb 12, 2007.

  1. BettyLu

    BettyLu Registered

    Joined:
    Oct 28, 2003
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    I have a server with cpanel, exim, apf, and bfd. It is running with a high load and it seems bfd is hanging. ive uninstaled and reinstalled bfd but i cant find any reason why its behaving like this.

    the load fluctuates in a matter of minutes

    it jumps up to over 3.00+ with bfd running. when i kill bfd it drops down to 0.30 or so

    ive seen loads as high as 5 or 6

    in top these are the first few entries:

    18667 root 25 0 2368 1100 808 S 3.0 0.1 0:09.00 bfd
    10748 mailnull 15 0 9872 2872 1852 S 1.7 0.2 0:00.05 exim
    11349 mailnull 15 0 10016 3512 2400 S 1.7 0.2 0:00.05 exim
    11213 mailnull 15 0 9872 2872 1852 S 1.3 0.2 0:00.04 exim
    11432 mailnull 15 0 9872 2872 1852 S 1.3 0.2 0:00.04 exim
    10810 mailnull 15 0 9872 2872 1852 S 0.3 0.2 0:00.04 exim


    and

    ps returns

    root 18628 0.0 0.0 2396 944 ? Ss 20:30 0:00 /bin/sh /usr/local/sbin/bfd -q
    root 18667 3.2 0.0 2368 1100 ? R 20:30 0:06 /bin/sh /usr/local/sbin/bfd -s
    root 16031 0.0 0.0 4188 664 pts/0 S+ 20:33 0:00 grep bfd
    root 16028 0.0 0.0 2368 300 ? R 20:33 0:00 /bin/sh /usr/local/sbin/bfd -s

    and lots of


    mailnull 22100 0.3 0.1 9872 2872 ? S 20:38 0:00 /usr/sbin/exim -bd -q60m
    mailnull 22105 0.4 0.2 10016 3512 ? S 20:38 0:00 /usr/sbin/exim -bd -q60m
    mailnull 22115 0.5 0.1 9872 2872 ? S 20:38 0:00 /usr/sbin/exim -bd -q60m
    mailnull 22117 0.6 0.1 9872 2872 ? S 20:38 0:00 /usr/sbin/exim -bd -q60m
    mailnull 22118 2.0 0.1 9872 2872 ? S 20:38 0:00 /usr/sbin/exim -bd -q60m


    any help on this matter would be appreciated. thank you in advance.
     
  2. vwiley1

    vwiley1 Well-Known Member

    Joined:
    Oct 4, 2003
    Messages:
    87
    Likes Received:
    0
    Trophy Points:
    6
    How large is your /var/log/messages ? A broken log rotator can quickly fill up your logs causing BFD to run much slower.
     
  3. AndyReed

    AndyReed Well-Known Member
    PartnerNOC

    Joined:
    May 29, 2004
    Messages:
    2,222
    Likes Received:
    3
    Trophy Points:
    38
    Location:
    Minneapolis, MN
    Does your server load stay constantly above 5? If yes, you have a serious problem and you need find out the true cause. To learn about the causes of server high load, go to: http://servertune.com/kbase/security/server_load.html
     
  4. gflamerich

    gflamerich Well-Known Member

    Joined:
    Jul 21, 2003
    Messages:
    122
    Likes Received:
    0
    Trophy Points:
    16
    BFD is executed by crond, and if there is to much time between each run, BDF will cause much load. Defult time is every 10min, we found this number to high, and also a little useless, no one wants an attack to last up to 10 min ..... You may test your config and decrease the time between run, so less lines will be analyzed each time.
    Obviously, it's not a solution for everyone, but you should try it.
    On the other hand, as BFD is rules based, some rules has a limit on log lines to analyze. The rules are located at /usr/local/bfd/rules (exim is one of the one that uses a limit)

    To edit manage bdf cron job, edit /etc/cron.d/bfd

    BDF rules are here: /usr/local/bfd/rules

    We have set our BFD to run every 4 min and check just the last 2000 lines and works very smooth.

    /etc/cron.d/bfd
    */4 * * * * root /usr/local/sbin/bfd -q

    Hope that helps
     
Loading...

Share This Page