Hi Chris, 
In answering your questions - 

What are the consequences of this? 
- From upstream comments here: https://github.com/OpenSCAP/openscap/pull/1803 
"That means that on systems with a small amount of memory it stops sooner that 
needed and on systems with a very large amount of memory it stops later than 
needed."
There is later discussions on Github and the conclusion is introducing this new 
environment variable OSCAP_PROBE_MEMORY_USAGE_RATIO will resolve the concerns 
here. And it lets the user customize the needed memory ratio, BUT this is 
something that we didn't do as apart of this patch because we only want the 
mimimal amount of changes. This is apart of this patch (1/3) 
https://github.com/OpenSCAP/openscap/pull/1803/commits/bb26be6ffcf2a88c09e4f237516ad71db555158f.
 This can be updated and added.

Will it generate a backlog of work to process, will it drop events, will it be 
slower, etc?
- It will throw a warning and fail that specific scanned directory and then it 
normally continues and finishes successfully.
W: probe_file: Memory usage ratio limit reached! limit=0.100000, 
current=0.312033, used=573 MB, free=131 MB, total=1837 MB, count of items=1001
Result  fail
... continue scanning..

redhat upstream bug report
https://bugzilla.redhat.com/show_bug.cgi?id=1932833

From this article I will summarize openscap memory-consumption problem.
https://access.redhat.com/articles/6999111
 
On systems with limited memory, openscap might terminate early or not generate 
the results file. OpenSCAP stores all collected results in the memory until the 
scan finishes. In general, we recommend having a system with a memory of at 
least 2 GB to complete a successful scan. There are multiple factors why memory 
consumption is so high.
Multiple various ways of dealing with over-consumption of memory listed in this 
redhat article as a workaround.


** Bug watch added: Red Hat Bugzilla #1932833
   https://bugzilla.redhat.com/show_bug.cgi?id=1932833

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2116751

Title:
  openscap probe_file process consumes excessive resources during CIS
  scan

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openscap/+bug/2116751/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to