Bug 1252048

Summary:	net-snmp snmpd fork() overhead [fix available]
Product:	Red Hat Enterprise Linux 7	Reporter:	Dalibor Pospíšil <dapospis>
Component:	net-snmp	Assignee:	Jan Safranek <jsafrane>
Status:	CLOSED ERRATA	QA Contact:	Dalibor Pospíšil <dapospis>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	7.1	CC:	andy.fletcher
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Cause: To improve security and to prevent file descriptor leaks, snmpd always closes all its filedescriptors when processing 'extend' or 'pass' configuration options. Doing so, it blindly closes all filedescriptors lower than current resource limit of opened files (ulimit -n, /proc/sys/fs/file-max). Consequence: When these limits are high, it may take some time to close these filedescriptors and snmpd thus slowly reacts to GET request in NET-SNMP-EXTEND-MIB::nsExtendOutput1Table. Fix: snmpd does not read resource limits from operating system, instead it finds out on its own which file descriptors it uses. Result: Requests in NET-SNMP-EXTEND-MIB::nsExtendOutput1Table are much faster.	Story Points:	---
Clone Of:	1188295	Environment:
Last Closed:	2015-11-19 11:46:12 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dalibor Pospíšil 2015-08-10 14:36:47 UTC

+++ This bug was initially created as a clone of Bug #1188295 +++

Description of problem:

NB. This is not limited to RHEL6 (also affects RHEL5/7).

Due to the way snmpd handles file descriptors when forking scripts for 'pass' or 'extend', on systems with very large numbers of FD, this will consume CPU and take several seconds for each OID.

Please consider back porting the following fix:
https://sourceforge.net/p/net-snmp/code/ci/0e4bf5d3659c459128c0f98926b0db7296e9c49f/


Version-Release number of selected component (if applicable):
Observed on all releases, including 5.7


How reproducible:
Every time

Steps to Reproduce:
1. increase fs-max/nofile to large value (32626630 in test case)
2. configure snmp pass or extend in snmpd.conf
3. get/walk the OID

Actual results:
Several seconds of 100% CPU utilisation, SNMP response takes several seconds.
snmpwalk (for 'pass' that support this) time out.

Expected results:
Immediate response, minimal CPU utilisation


Additional info:
Please consider back porting the following fix:
https://sourceforge.net/p/net-snmp/code/ci/0e4bf5d3659c459128c0f98926b0db7296e9c49f/

Comment 4 errata-xmlrpc 2015-11-19 11:46:12 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2345.html