I have Centos 7 fresh install and I see setroubleshootd with high CPU usage. How can I fix this? What is this process doing?
Centos – setroubleshootd excessive cpu and memory usage
centoscpu usageselinux
centoscpu usageselinux
I have Centos 7 fresh install and I see setroubleshootd with high CPU usage. How can I fix this? What is this process doing?
Best Answer
First of all, you should not disable SELinux. So what could cause the high CPU usage of
setroubleshootd
.Try to find out in which mode SELinux is running on the machine by typing
sestatus
. It should show several lines. The interesting parts areSELinux status:
andCurrent Mode
which are usuallyenabled
andenforcing
. If the current mode ispermissive
, then SELinux does not block anything but only logs it (good for troubleshooting).Assuming SELinux is enabled and in in enforcing mode, now take a look at the log
/var/log/audit/audit.log
. I would recommend to usetail -f /var/log/audit/audit.log
to see live changes of the file.Because you have high CPU load of
setroubleshootd
I assume you have permanent changes/entries in the file, meaning something permanently violates the SELinux policy and the output could give you a first clue why.For more in depth troubleshooting you could install
setroubleshoot-server
withyum install setroubleshoot-server
. This package is a set of tools that can help you to find the real cause of the SELinux violation. Most of the time it happens when you added files to the system without setting the correct SELinux permissions or a process tries to access a non typical file or folder.I would recommend you read this document about SELinux first and this document to get an overview and then look at documents like this for your distribution.
There is a bit of a learning curve with SELinux and too much for a simple answer, but I would never ever disable it on a public facing server.