[psad-discuss] Re: Diskmond Processes

[Francesca C. S. <fs...@la...>]

I Just lowered the threshold to 75 % and its working fine now ..
Although I might tune tweak that number a bit here and there.

-- 
Francesca C Smith
Lady Linux Internet Services
1801 Bolton Street # 1
Baltimore, MD 21217


>  Greetings,
>  
>  Since installing psad-1.2 on a Redhat 7.3 I have hundreds of /usr/sbin/diskmond processes
> showing when i do ps aux; although it appears from running top that they are sleeping. Is
> this normal?
>  
>  For now I had to kill diskmond because it seems more trouble than it's worth, as well as
> unfortunately psadwatchd to prevent it from starting it again.
>  
>  Am I missing something? How do I disable diskmond without killing it?
>  
>  I also tend to run psad --no-rdns --no-whois and want to enable it at boot time. Do I have
> to remove psad from /etc/rc*.d/ and add /usr/sbin/psad --no-whois --no-rdns to the
> /etc/rc.d/rc.local, or is there an easier way?
>  


> Hi Ciapto -
>  
>  Oh crap.  That is a bug with diskmond.  I will need to
>  fix this and have another release, say, 1.2.1.  In the
>  meantime can you send me the output of "df -k /var"? 
>  If the percentage utilization is greater than the
>  threshold defined by the MAX_DISK_PERCENTAGE variable
>  in /etc/psad/diskmond.conf then I would recommend that
>  you increase the threshold (this will also cause
>  diskmond to not spawn so many processes).
>  
>  About your second question, probably the easiest way
>  would be to change the "daemon /usr/sbin/psad" line in
>  /etc/rc.d/init.d/psad to:
>  
>  daemon /usr/sbin/psad --no-rdns --no-whois
>  
>  I think this will work.
>  
>  --Mike