1

I have Centos 7 fresh install and I see setroubleshootd with high CPU usage. How can I fix this? What is this process doing?

  • Are there SELinux issues logged in /var/log/audit/audit.log (AVC denials)? – sebasth Apr 5 at 15:47
  • well, yes, there is something connected with mongodb there... – stiv Apr 5 at 15:51
1

First of all, you should not disable SELinux. So what could cause the high CPU usage of setroubleshootd.

Try to find out in which mode SELinux is running on the machine by typing sestatus. It should show several lines. The interesting parts are SELinux status: and Current Mode which are usually enabled and enforcing. If the current mode is permissive, then SELinux does not block anything but only logs it (good for troubleshooting).

Assuming SELinux is enabled and in in enforcing mode, now take a look at the log /var/log/audit/audit.log. I would recommend to use tail -f /var/log/audit/audit.log to see live changes of the file.

Because you have high CPU load of setroubleshootd I assume you have permanent changes/entries in the file, meaning something permanently violates the SELinux policy and the output could give you a first clue why.

For more in depth troubleshooting you could install setroubleshoot-server with yum install setroubleshoot-server. This package is a set of tools that can help you to find the real cause of the SELinux violation. Most of the time it happens when you added files to the system without setting the correct SELinux permissions or a process tries to access a non typical file or folder.

I would recommend you read this document about SELinux first and this document to get an overview and then look at documents like this for your distribution.

There is a bit of a learning curve with SELinux and too much for a simple answer, but I would never ever disable it on a public facing server.

  • that setroubleshoot-server actually is setroubleshootd ... – Martin Zeitler Apr 12 at 0:54
0

a) Install setroubleshoot.x86_64 for a GUI; this might be easier than using tail.

# yum install setroubleshoot.x86_64 setroubleshoot-plugins.noarch

Adding SE Linux policies for mongodb (and possible others) might reduce the load.

Please note that the suggestions it makes can sometimes be useless/misleading.

b) Reinstalling setroubleshootd might be an option:

yum reinstall setroubleshoot-server
-1

That daemon setroubleshootd is part of SELinux (Security Enhanced Linux). SELinux was implented to provide a context type to files to add more security and comply with NSA requirements. SELinux can cause issues if not properly configured and employed. Setroubleshootd monitors and reports SELinux issues, and provides resolution recommendations.

Determine if you actually need SELinux to run. If not, disable it.

Click here for more info on Disabling SELinux.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.