LibreNMS offers prebuilt OVA VM images using packer.io based on Ubuntu 18 and CentOS 7. If you’ve deployed the CentOS image though, you may be aware of it using an excessive amount of CPU – not an issue present in the Ubuntu image.
A quick look at the system with
top will show us
php processes with new PIDs spiking the CPU endlessly. Output of
ps axf will show the parent process as
syslog-ng, whose config has a PHP script defined as a program which it is trying to launch. Turning on debugging in
syslog-ng doesn’t return any information on what is happening so when something on an RHEL based system doesn’t make sense, what do you do? Check if SELinux is enforcing and look at your audit logs!