{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/890","labels_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/890/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/890/comments","events_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/890/events","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/890","id":79941197,"number":890,"title":"Spontaneously high CPU usage","user":{"login":"celesteking","id":748075,"avatar_url":"https://avatars.githubusercontent.com/u/748075?v=3","gravatar_id":"","url":"https://api.github.com/users/celesteking","html_url":"https://github.com/celesteking","followers_url":"https://api.github.com/users/celesteking/followers","following_url":"https://api.github.com/users/celesteking/following{/other_user}","gists_url":"https://api.github.com/users/celesteking/gists{/gist_id}","starred_url":"https://api.github.com/users/celesteking/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/celesteking/subscriptions","organizations_url":"https://api.github.com/users/celesteking/orgs","repos_url":"https://api.github.com/users/celesteking/repos","events_url":"https://api.github.com/users/celesteking/events{/privacy}","received_events_url":"https://api.github.com/users/celesteking/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-05-23T20:10:24Z","updated_at":"2015-05-30T15:34:24Z","closed_at":null,"body":"This bug is hard to replicate, but I'll try to describe it here.\r\nWe've activated modsec on our servers, but with some we're noticing extremely high cpu usage. It manifests itself after running for some time in detection mode. \r\nWe have mlogc logging enabled. \r\n\r\nIt might be caused by graceful restart, although I'm not sure -- no way to replicate reliably. \r\n\r\nHere's what happens with a process that's consuming 100% CPU:\r\n```\r\n(gdb) bt\r\n#0  0x00002b36cebad969 in run_child_cleanups () from /usr/local/apache/lib/libapr-1.so.0\r\n#1  0x00002b36cebad9af in cleanup_pool_for_exec () from /usr/local/apache/lib/libapr-1.so.0\r\n#2  0x00002b36cebad9c6 in cleanup_pool_for_exec () from /usr/local/apache/lib/libapr-1.so.0\r\n#3  0x00002b36cebad9c6 in cleanup_pool_for_exec () from /usr/local/apache/lib/libapr-1.so.0\r\n#4  0x00002b36cebad9eb in apr_pool_cleanup_for_exec () from /usr/local/apache/lib/libapr-1.so.0\r\n#5  0x00002b36cebba4e9 in apr_proc_create () from /usr/local/apache/lib/libapr-1.so.0\r\n#6  0x00002b36cf1e86c2 in suphp_script_handler (r=0x1122ceb8) at mod_suphp.c:953\r\n#7  0x00002b36cf1e8ef9 in suphp_handler (r=0x1122ceb8) at mod_suphp.c:569\r\n#8  0x000000000044ac13 in ap_run_handler ()\r\n#9  0x000000000044b4dc in ap_invoke_handler ()\r\n#10 0x00000000004b9ddd in ap_internal_redirect ()\r\n#11 0x00000000004e1f11 in handler_redirect ()\r\n#12 0x000000000044ac13 in ap_run_handler ()\r\n#13 0x000000000044b4dc in ap_invoke_handler ()\r\n#14 0x00000000004b9ddd in ap_internal_redirect ()\r\n#15 0x00000000004b90d3 in ap_die ()\r\n#16 0x00000000004b92ca in ap_process_request ()\r\n#17 0x00000000004b5abd in ap_process_http_connection ()\r\n#18 0x00000000004546cf in ap_run_process_connection ()\r\n#19 0x0000000000454b33 in ap_process_connection ()\r\n#20 0x00000000004e3157 in process_socket ()\r\n#21 0x00000000004e3a82 in worker_thread ()\r\n#22 0x00002b36cebbb3a1 in dummy_worker () from /usr/local/apache/lib/libapr-1.so.0\r\n#23 0x00000037c180683d in start_thread () from /lib64/libpthread.so.0\r\n#24 0x00000037c10d4fcd in clone () from /lib64/libc.so.6\r\n```\r\nstrace tells nothing (as far as I tried). apache running perfectly fine without modsec (SecRuleEngine Off).\r\n\r\n```\r\n# httpd  -V\r\nServer version: Apache/2.2.29 (Unix)\r\nServer built:   May 14 2015 10:34:22\r\nCpanel::Easy::Apache v3.28.8 rev9999\r\nServer's Module Magic Number: 20051115:36\r\nServer loaded:  APR 1.5.1, APR-Util 1.5.4\r\nCompiled using: APR 1.5.1, APR-Util 1.5.4\r\nArchitecture:   64-bit\r\nServer MPM:     Worker\r\n  threaded:     yes (fixed thread count)\r\n    forked:     yes (variable process count)\r\nServer compiled with....\r\n -D APACHE_MPM_DIR=\"server/mpm/worker\"\r\n -D APR_HAS_SENDFILE\r\n -D APR_HAS_MMAP\r\n -D APR_HAVE_IPV6 (IPv4-mapped addresses disabled)\r\n -D APR_USE_SYSVSEM_SERIALIZE\r\n -D APR_USE_PTHREAD_SERIALIZE\r\n -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT\r\n -D APR_HAS_OTHER_CHILD\r\n -D AP_HAVE_RELIABLE_PIPED_LOGS\r\n -D DYNAMIC_MODULE_LIMIT=128\r\n -D HTTPD_ROOT=\"/usr/local/apache\"\r\n -D SUEXEC_BIN=\"/usr/local/apache/bin/suexec\"\r\n -D DEFAULT_SCOREBOARD=\"logs/apache_runtime_status\"\r\n -D DEFAULT_ERRORLOG=\"logs/error_log\"\r\n -D AP_TYPES_CONFIG_FILE=\"conf/mime.types\"\r\n -D SERVER_CONFIG_FILE=\"conf/httpd.conf\"\r\n```\r\n\r\nHopefully, will have more info as we gather stats. "},"comment":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/comments/107054093","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/890#issuecomment-107054093","issue_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/890","id":107054093,"user":{"login":"celesteking","id":748075,"avatar_url":"https://avatars.githubusercontent.com/u/748075?v=3","gravatar_id":"","url":"https://api.github.com/users/celesteking","html_url":"https://github.com/celesteking","followers_url":"https://api.github.com/users/celesteking/followers","following_url":"https://api.github.com/users/celesteking/following{/other_user}","gists_url":"https://api.github.com/users/celesteking/gists{/gist_id}","starred_url":"https://api.github.com/users/celesteking/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/celesteking/subscriptions","organizations_url":"https://api.github.com/users/celesteking/orgs","repos_url":"https://api.github.com/users/celesteking/repos","events_url":"https://api.github.com/users/celesteking/events{/privacy}","received_events_url":"https://api.github.com/users/celesteking/received_events","type":"User","site_admin":false},"created_at":"2015-05-30T15:34:24Z","updated_at":"2015-05-30T15:34:24Z","body":"Anyone having similar problems? Basically, the module is unusable at current state. "}}