MSEC got crazy my cpu for a minute aprox

[Aleph]

Hi friends,

lately I got some messages from MSEC and my CPU got crazy for 1 minute aprox.

Here is a extract of var/log/msec.log

Code: [Select]

2012-02-25 09:01:02,450 INFO: Forbidding the X server to listen to tcp connection
2012-02-25 09:01:02,517 INFO: Password history not supported with pam_tcb.
2012-02-25 09:01:02,532 INFO: No changes in system files
2012-02-25 16:01:02,614 INFO: Forbidding the X server to listen to tcp connection
2012-02-25 16:01:02,681 INFO: Password history not supported with pam_tcb.
2012-02-25 16:01:02,689 INFO: No changes in system files
2012-02-26 00:01:02,924 INFO: Forbidding the X server to listen to tcp connection
2012-02-26 00:01:03,005 INFO: Password history not supported with pam_tcb.
2012-02-26 00:01:03,013 INFO: No changes in system files
2012-02-26 16:01:02,484 INFO: Forbidding the X server to listen to tcp connection
2012-02-26 16:01:02,561 INFO: Password history not supported with pam_tcb.
2012-02-26 16:01:02,569 INFO: No changes in system files
2012-02-27 00:01:02,029 INFO: Forbidding the X server to listen to tcp connection
2012-02-27 00:01:02,101 INFO: Password history not supported with pam_tcb.
2012-02-27 00:01:02,109 INFO: No changes in system files
2012-02-28 00:01:02,682 INFO: Forbidding the X server to listen to tcp connection
2012-02-28 00:01:02,749 INFO: Password history not supported with pam_tcb.
2012-02-28 00:01:02,758 INFO: No changes in system files
2012-02-28 01:01:03,156 INFO: Forbidding the X server to listen to tcp connection
2012-02-28 01:01:03,232 INFO: Password history not supported with pam_tcb.
2012-02-28 01:01:03,254 INFO: No changes in system files
2012-02-28 15:01:02,695 INFO: Forbidding the X server to listen to tcp connection
2012-02-28 15:01:02,768 INFO: Password history not supported with pam_tcb.
2012-02-28 15:01:02,778 INFO: No changes in system files
2012-02-28 15:45:28,632 WARNING: Enforcing group on /var/log/security/mail.today to adm
2012-02-28 15:45:28,645 WARNING: Enforcing permissions on /var/log/security/mail.today to 640
2012-02-28 15:45:28,645 WARNING: Enforcing group on /var/log/security/suid_md5.today to adm
2012-02-28 15:45:28,645 WARNING: Enforcing permissions on /var/log/security/suid_md5.today to 640
2012-02-28 16:01:03,369 INFO: Forbidding the X server to listen to tcp connection
2012-02-28 16:01:03,438 INFO: Password history not supported with pam_tcb.
2012-02-28 16:01:03,458 INFO: No changes in system files
2012-02-28 16:07:05,772 WARNING: Enforcing group on /var/log/security/mail.today to adm
2012-02-28 16:07:05,870 WARNING: Enforcing permissions on /var/log/security/mail.today to 640
2012-02-28 17:01:03,345 INFO: Forbidding the X server to listen to tcp connection
2012-02-28 17:01:03,407 INFO: Password history not supported with pam_tcb.
2012-02-28 17:01:03,434 INFO: No changes in system files
2012-02-28 23:01:03,010 INFO: Forbidding the X server to listen to tcp connection
2012-02-28 23:01:03,096 INFO: Password history not supported with pam_tcb.
2012-02-28 23:01:03,105 INFO: No changes in system files
2012-02-29 20:01:03,690 INFO: Forbidding the X server to listen to tcp connection
2012-02-29 20:01:03,756 INFO: Password history not supported with pam_tcb.
2012-02-29 20:01:03,764 INFO: No changes in system files
2012-02-29 20:24:32,176 WARNING: Enforcing group on /var/log/security/mail.today to adm
2012-02-29 20:24:32,176 WARNING: Enforcing permissions on /var/log/security/mail.today to 640
2012-02-29 20:24:32,177 WARNING: Enforcing group on /var/log/security/suid_md5.today to adm
2012-02-29 20:24:32,177 WARNING: Enforcing permissions on /var/log/security/suid_md5.today to 640
2012-02-29 22:01:02,630 INFO: Forbidding the X server to listen to tcp connection
2012-02-29 22:01:02,698 INFO: Password history not supported with pam_tcb.
2012-02-29 22:01:02,706 INFO: No changes in system files
2012-02-29 23:01:06,260 INFO: Forbidding the X server to listen to tcp connection
2012-02-29 23:01:06,568 INFO: Password history not supported with pam_tcb.
2012-02-29 23:01:06,804 INFO: No changes in system files
2012-03-01 15:01:02,371 INFO: Forbidding the X server to listen to tcp connection
2012-03-01 15:01:02,439 INFO: Password history not supported with pam_tcb.
2012-03-01 15:01:02,447 INFO: No changes in system files
2012-03-01 15:39:44,716 WARNING: Enforcing group on /var/log/security/mail.today to adm
2012-03-01 15:39:44,717 WARNING: Enforcing permissions on /var/log/security/mail.today to 640
2012-03-01 15:39:44,717 WARNING: Enforcing group on /var/log/security.log to adm
2012-03-01 15:39:44,717 WARNING: Enforcing permissions on /var/log/security.log to 640
2012-03-01 15:39:44,718 WARNING: Enforcing group on /var/log/security/suid_md5.today to adm
2012-03-01 15:39:44,718 WARNING: Enforcing permissions on /var/log/security/suid_md5.today to 640

Any advice?

Thanks.

[Aleph]

Is everything normal?

[djohnston]

Aleph,

Those appear to be normal. My log shows a lot of those, going back to 2011-09-30, which is the last time the log was rotated.

They could be coming from one of the following cron job runs:

/etc/cron.daily/msec
/etc/cron.hourly/msec
/etc/cron.monthly/msec
/etc/cron.weekly/msec

[Aleph]

Then, the high cpu activity is normal too?

I can see MSEC is the guilty of such activity.

[gandy]

There was a thread about this awhile back. It seems that MSEC does a security check periodically, and has been doing it in the background for a long time.

I noticed a popup, from the tray, that mentioned a check that had been performed. I never saw it before so the notification must be new.

Evidently, it's normal so I left it alone.

[monsee]

You can disable the check, if you like... and -after this- you can start the check "not-automatically", aka as you like (and when you like).
I have disabled it and launch it when I like to have a chack.

[Aleph]

I am calmer. Everything is normal, I'll try disable the check, the cpu is 100% when MSEC is running...

Thanks friends!