Open-AudIT

What's on your network?
It is currently Sat Apr 21, 2018 3:52 am

All times are UTC + 10 hours




Post new topic Reply to topic  [ 5 posts ] 
Author Message
PostPosted: Fri Mar 14, 2014 9:05 am 
Offline
Newbie

Joined: Fri Mar 14, 2014 7:30 am
Posts: 6
Hello!

I'm new to Open-AudIT, but so far, so good! I'm running on 64bit Ubuntu Server 12.04.4. Everything seems to be working well.

I've been poking around with the settings via the web interface and have successfully scanned a few windows and linux machines. I'm ready to take the plunge and scan a subnet!

So, I did. I watched the logs for a while, and computers are starting to be found and complete their audits! Very cool! Unfortunately, after about 20 or so machines, I get this error:
Unable to connect to your database server using the provided settings.

Filename: core/Loader.php

Line Number: 346

Hmmm...

I checked on the server with htop, but I'm only using 250mb of RAM and 1/4 of the CPU. So, it's not being overloaded. Is there something else that could cause this error? I'll wait for a few hours to see if maybe it's just temporary scanning load bumping up against the PHP memory limit (set at 512, per the installation documentation).

Also, Debug mode for this scan is not turned on :)

Thanks! I'd be happy to provide more info as needed! Also, what are the minimum RAM requirements for an Open AudIT server? I'd like to scan from it and we have roughly 225 devices on our network.

Stead Halstead
Eugene, OR, USA


Top
 Profile  
Reply with quote  
PostPosted: Fri Mar 14, 2014 10:07 am 
Offline
Newbie

Joined: Fri Mar 14, 2014 7:30 am
Posts: 6
Further information! This is from the syslog:

Mar 13 15:51:21 openaudit kernel: [ 644.584211] Out of memory: Kill process 764 (mysqld) score 37 or sacrifice child
Mar 13 15:51:21 openaudit kernel: [ 644.584232] Killed process 764 (mysqld) total-vm:894476kB, anon-rss:29572kB, file-rss:0kB

I've seen the place to limit the domain scans to a certain number of processes/machines scanning. Is this possible on a subnet scan?

Thanks!

-Stead


Top
 Profile  
Reply with quote  
PostPosted: Sat Mar 15, 2014 1:22 pm 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1944
Location: Brisbane, Australia
Interesting - yes it looks like you're running out of memory and the process is restarting.
I've not encountered this before.

I haven't really thought about limiting Discovery... Maybe I will need to ?!!?

I'd start by specifying a smaller subnet and see how you go. Don't forget just because your machines are in 192.168.1.0/24 doesn't mean you have to scan that particular complete subnet. You can also use (for example) 192.168.1.1-20 on the Discovery form.

_________________
Support and Development hours available from Opmantek.
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
PostPosted: Sat Mar 15, 2014 3:04 pm 
Offline
Newbie

Joined: Fri Mar 14, 2014 7:30 am
Posts: 6
Thanks Mark! I'll probably focus on getting active directory scanning working, since that's the end goal. Using a mask to tighten up the subnet would work well though. Thanks for the suggestion!

Also, that's very good to know about being able to use the IP range on the scan form. Very cool! Thanks!


Top
 Profile  
Reply with quote  
PostPosted: Wed Jan 07, 2015 2:44 pm 
Offline
Newbie

Joined: Wed Jan 07, 2015 5:46 am
Posts: 1
very nice of you Mr.steadhouse......

_________________
Arslan1!


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 5 posts ] 

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group