Rkhunter 100% CPU :-(

Discussion in 'Installation/Configuration' started by beryl, Jul 18, 2009.

  1. beryl

    beryl Member


    How can i set Rkhunter to run less often or disable it, it runs for 10 minutes every hour consuming 100% CPU.
  2. thaibinhtt

    thaibinhtt New Member

    Yes, I caught the same problem. Who anybody can resolve it ?
    Last edited: Jul 18, 2009
  3. dzudzu

    dzudzu New Member

    i am also interested in where can i modify all the jobs ispconfig runs?

    Also i'm wondering where is that writen, i followed a crontab and jobs that are there to be executed but didn't quite manage to get in track what jobs are done and with what commands so can we have some light on this :)
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    In the next version of ISPConfig rkhunter will run only once a day, this has been fixed in svn a few weeks ago.

    Take a look at the monitor module, all monitoring actions are executed from there. The monitor module is in /usr/local/ispconfig/server/mods-available/
  5. beryl

    beryl Member

    How do i change it to run daily, without breaking the production server?
  6. dzudzu

    dzudzu New Member


    * This monitoring is expensive, so do it only once a hour
    $min = date('i');
    $hour = date('H');
    if ($min != 0 && $hour != 23) return;

    so it says if it is not 0 minutes and not 23 hour not to run rkhunter...

    well i have modifies the line

    $data['output'] = shell_exec('rkhunter --update --checkall --nocolors --skip-keypress');

    to just

    $data['output'] = ''; so it doesn't run rkhunter at all, but my question is now?

    why above IF doesn't work or am i reading the code wrong?
  7. dzudzu

    dzudzu New Member

    another thing as a quick fix i comeup with then is after u remove runing the rkhunter like that u can enable it with crontab so with

    crontab -e

    and add line from the php conf file

    30 09 * * * rkhunter --update --checkall --nocolors --skip-keypress &> /dev/null

    so it will run only at 09:30 everyday

    think this is good
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    Thst not a fix at all. All monitoring in ispconfig is done by the monitoring module, if you run rkhunter externally you will not get an result anymore and it renders the monitoring completely useless.

    The above if stement is working fine on my systems, rkhunter is just run once a day. If it is run more often on your server, then there might be another software starting it.
  9. dzudzu

    dzudzu New Member

    i was just following up on topic the first user stated

    and it says it's runing every hour, cos it seemed not right for the if statment not work, so i just started playing around for viable options. Ofc if u do it manualy renders the monitor ability completely but i just made up example of it. Just want to know the system better :)

    I got ispconfig 3 on my centos 5.3 and works like a charm and thanks for making it :)
  10. beryl

    beryl Member

    The server is set up exactly as perfect setup for debian lenny, so there is no other software starting it.

    Still rkhunter runs ever hour or so.

    I will try dzudzu´s fix, thank you for posting it!

Share This Page