advice on program

[tenaciousdave]

hi, bit of a basic question but kind of need help ASAP. I am running a dedicated server on RedHat, but think this is just more specific to unix.

The server load seems to have increased dramatically, even after restart. When I logged in with SSH and ran the command top I got the following


PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND
2917 root 20 0 318M 318M 660 R 42.3 64.6 0:20 analog

This really seems to be the main offender. I run some php scripts and have some pretty active database use but is there anything I can do about this program? is it completly necessary? should I restrict it's use of the systems memory and CPU usage?

Any help would be greatly appreciated.

 

[Salem]

A quick scan round the net revealed this - though I doubt its the problem.

http://www.nacs.uci.edu/security/archive/msg00395.html

Having found out that its a log analysis tool, my first question would be - when did you last purge your log files?
If they've grown to several GB, the tool will suffer as a result of all that information.

> is it completly necessary?
Depends - it seems to be for analysing logs, so I would assume someone is reading its output. If no one is, then
- either they should
- or running the program is a waste of time

You might also want to look at the information being written into the log files - since this can cause them to fill up rapidly with useless information.


> should I restrict it's use of the systems memory and CPU usage?
You can restrict the CPU usage using the 'nice' command to alter the priority - which alters how much CPU the process gets.
You can limit the memory, but most programs react to that by simply dying when they run out.

 

[tarn]

analog is a web log analys tool, I would guess that it has been configured to do DNS lookups and is working hard to trawl through your log.

Look for /etc/analog.conf and check the settings.

I would suggest also setting up your /var/log/httpd/access.log to be rolled daily this will help analog process things only once, as it is it probabaly trawls the same (growing) log every day.

to roll the logs just modify the entry in /etc/httpd/conf/httpd.conf ...
TransferLog "| rotatelogs /path/to/logs/access.log 86400"

Good Luck,
Laurie.