ebs12.2.12 application go down

[raiq1]

Dear Erman sir,

I am facing a issue for last few days that our test ebs application 12.2.12 are going down immediately , make sure it is a VM in ODA server.

The issue is started 10 days ago after my Network Administrator are inform me that there is an malicious activity are happening in my test server . he has blocked ssh 22 port, so no body can access this server.

One more thing i notice that if i used top command, there is one process kauditd0 are occuping 90% cpu resource, even i killed this process again the new process is appeared.

Below is the output of top command.



top - 09:32:20 up 19:36,  3 users,  load average: 3.35, 3.54, 4.07
Tasks: 334 total,   2 running, 271 sleeping,   0 stopped,   0 zombie
%Cpu(s): 95.0 us,  4.2 sy,  0.0 ni,  0.0 id,  0.0 wa,  0.8 hi,  0.0 si,  0.0 st
KiB Mem : 32874032 total,  4121524 free, 23468136 used,  5284372 buff/cache
KiB Swap: 16777212 total, 16776688 free,      524 used.  9023188 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
 2175 root      20   0 3193444   7152      4 S 178.4  0.0   2229:40 kauditd0
13122 root      20   0  110196   2644   1964 S   1.3  0.0   0:00.04 pidstat
13074 applclo+  20   0  447892 146508  12144 S   1.0  0.4   0:08.60 java
 3389 appltest  20   0  114904   3184   2836 S   0.7  0.0   1:27.19 bash


Kindly guide me , how to fix this kauditd0 issue.

Regards,
Raiq

[ErmanArslansOracleBlog]

That s a kernel thread. So it is there, running from root..
It seems your Network admin already spotted something.
The high cpu usage of kauditd0 may be the result of that. But with his info, I can't be sure.. Besides, your Network administrator's comment creates bias.

Checke kauditd0's activity , does it really write a lot of audit records to the audit log or somewhere else..  If so, why? Check /var/log/messages as well.. A general, wider control is needed here. Also ensure you are on a stable linux release (with all the stable up-to-date versions of the relevant packages are installed -- including the ones related with kauditd)