search

carbonblack / cb-yara-connector

Analyze binaries collected in VMware Carbon Black EDR against Yara rules.
36 stars 8 forks source link

yara connector generates high system CPU time #8

Closed jjguy closed 3 years ago

jjguy commented 8 years ago

reviewing system with sustained ~10-20% kernel CPU times:

grafana_-_server_overview

using pidstat to find the culprit shows yara connector:

[root@localhost solr]# pidstat 5 | tee /tmp/fu.txt
...
^C
[root@localhost solr]# cat /tmp/fu.txt | grep yara
04:25:57 AM       PID    %usr %system  %guest    %CPU   CPU  Command
04:25:42 AM      9505   65.41   22.66    0.00   88.07     3  cb-yara-connect
04:25:47 AM      9505   70.20   20.80    0.00   91.00     3  cb-yara-connect
04:25:52 AM      9505   68.80   22.20    0.00   91.00     3  cb-yara-connect
04:25:57 AM      9505   66.20   21.60    0.00   87.80     3  cb-yara-connect
04:26:02 AM      9505   67.60   21.20    0.00   88.80     3  cb-yara-connect
[root@localhost solr]#