Rkhunter 100% CPU :-(

[beryl]

Hello,

How can i set Rkhunter to run less often or disable it, it runs for 10 minutes every hour consuming 100% CPU.

[thaibinhtt]

Yes, I caught the same problem. Who anybody can resolve it ?

[dzudzu]

i am also interested in where can i modify all the jobs ispconfig runs?

Also i'm wondering where is that writen, i followed a crontab and jobs that are there to be executed but didn't quite manage to get in track what jobs are done and with what commands so can we have some light on this

[till]

In the next version of ISPConfig rkhunter will run only once a day, this has been fixed in svn a few weeks ago.

Also i'm wondering where is that writen, i followed a crontab and jobs that are there to be executed but didn't quite manage to get in track what jobs are done and with what commands so can we have some light on this

Take a look at the monitor module, all monitoring actions are executed from there. The monitor module is in /usr/local/ispconfig/server/mods-available/

[beryl]

How do i change it to run daily, without breaking the production server?

[dzudzu]

hmmm

/*
* This monitoring is expensive, so do it only once a hour
*/
$min = date('i');
$hour = date('H');
if ($min != 0 && $hour != 23) return;

so it says if it is not 0 minutes and not 23 hour not to run rkhunter...

well i have modifies the line

$data['output'] = shell_exec('rkhunter --update --checkall --nocolors --skip-keypress');

to just

$data['output'] = ''; so it doesn't run rkhunter at all, but my question is now?

why above IF doesn't work or am i reading the code wrong?

[dzudzu]

another thing as a quick fix i comeup with then is after u remove runing the rkhunter like that u can enable it with crontab so with

crontab -e

and add line from the php conf file

30 09 * * * rkhunter --update --checkall --nocolors --skip-keypress &> /dev/null

so it will run only at 09:30 everyday

think this is good

[till]

Thst not a fix at all. All monitoring in ispconfig is done by the monitoring module, if you run rkhunter externally you will not get an result anymore and it renders the monitoring completely useless.

The above if stement is working fine on my systems, rkhunter is just run once a day. If it is run more often on your server, then there might be another software starting it.

[dzudzu]

i was just following up on topic the first user stated

How can i set Rkhunter to run less often or disable it, it runs for 10 minutes every hour consuming 100% CPU.

and it says it's runing every hour, cos it seemed not right for the if statment not work, so i just started playing around for viable options. Ofc if u do it manualy renders the monitor ability completely but i just made up example of it. Just want to know the system better

I got ispconfig 3 on my centos 5.3 and works like a charm and thanks for making it

[beryl]

The server is set up exactly as perfect setup for debian lenny, so there is no other software starting it.

Still rkhunter runs ever hour or so.

I will try dzudzu´s fix, thank you for posting it!