Hello forum, I want to bring in your notice about the recent activity I have seen which resulted from the scan of the machine running gmond service on port 8649.
The scan was performed using famous nessus scanner and as result the service crashes or the service was unavailable due to high CPU utilization. The reason cited by support, was the service received non-atmos application. Atmos? because this is what is used in our environment which is powered by emc storage. Also, what more is said is that "Note that gmond slave nodes not expected to receive package from 8649 port". So, in short an arbitrary data was send to the port and resulted into crash and high cpu utilization. Further outputs shows:- 18968 root 20 0 354m 30m 19m S 100 0.1 5503:13 gmond 6944 root 20 0 58904 1256 788 S 0 0.0 24:55.65 gmondproxy The support from emc put this as ..."gmond service on the RMG1 nodes were returning obsolete metrics to RMS and RMS thought those node are disconnected. It is suspect gmond was stuck trying to receiving unexpected packages from port 8649. On RMG1 nodes (even gmond slave nodes), receive Q of that socket was high and application is not reading data from it." I want to know as dev are you aware of the known problems related to service disruption caused by scanning these ports. If its a known issue, I want to know where I can get update/patch for it. I appreciate if you can explain the matter to me in some details. thanks. regards, asad ------------------------------------------------------------------------------ "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE Instantly run your Selenium tests across 300+ browser/OS combos. Get unparalleled scalability from the best Selenium testing platform available Simple to use. Nothing to install. Get started now for free." http://p.sf.net/sfu/SauceLabs _______________________________________________ Ganglia-developers mailing list Ganglia-developers@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/ganglia-developers
