search

linux-application-whitelisting / fapolicyd

File Access Policy Daemon
GNU General Public License v3.0
192 stars 55 forks source link

Tuning FAPolicy Guidance #312

Open smhanes15 opened 1 month ago

smhanes15 commented 1 month ago

RHEL-8 host running newest available kernel. Periodically see a host go down with "Core dump to | /bin/false pipe failed". 12 CPUs and 20GB RAM. No other host is approaching the numbers below. Seeking tuning guidance.

Suspicion is fapolicy isn't tuned well to the workload this host performs.

Within 10 minutes of starting the host up, fapolicy statistics has output such as:

Permissive: false q_size: 800 Inter-thread max queue depth 0 Allowed accesses: 9,467,715 Denied accesses: 1 Trust database max pages: 12800 Trust database pages in use: 3012 (23%)

Subject cache size: 32,687 Subject slots in use: 32,687 (100%) Subject hits: 9,435,029 Subject misses: 428,018 Subject evictions: 395,331 (4%)

Object cache size: 20,483 Object slots in use: 7943 (38%) Object hits: 9,459,772 Object misses: 12,292 Object evictions: 4349 (0%)

radosroka commented 1 month ago

Does this happen also with permissive=true? Stats looks good nothing irregular.