Entropy related problems¶
In headless servers, sometimes Java processes hangs waiting on a thread that’s continuously in wait status, trying to generate random numbers, because entropy is too low to generate enough random numbers.
Check the entropy level with the following command:
$ cat /proc/sys/kernel/random/entropy_avail
If the obtained value is less than 1000, entropy is too low. This problem can be solved in two different way:
- Running
haveged
daemon; - Configure Argus daemons to use
/dev/urandom
as random device.
Run Haveged¶
Install EPEL repository and haveged
package:
$ sudo yum install -y epel-release
$ sudo yum install -y haveged
Enable and run the daemon. On EL7 platforms:
$ sudo systemctl enable haveged
$ sudo systemctl start haveged
On EL6 platforms:
$ sudo chkconfig haveged on
$ sudo service haveged start
Change random device¶
Edit the Argus services environment files, adding the option
-Djava.security.egd=file:/dev/urandom
to the Java options.
For the PAP service, edit the PAP_JAVA_OPTS
variable in
/etc/sysconfig/argus-pap
file. Example:
PAP_JAVA_OPTS="-Djava.security.egd=file:/dev/urandom"
For the PDP service, edit the PDP_JOPTS
variable in
/etc/sysconfig/argus-pdp
file. Example:
PDP_JOPTS="-Xmx256M -Djdk.tls.trustNameService=true -Djava.security.egd=file:/dev/urandom"
For the PEP daemon, edit the PEPD_JOPTS
variable in
/etc/sysconfig/argus-pepd
file. Example:
PEPD_JOPTS="-Xmx256M -Djdk.tls.trustNameService=true -Djava.security.egd=file:/dev/urandom"
Then restart the services. On EL7 platforms:
$ sudo systemctl restart argus-pap argus-pdp argus-pepd
On EL6 platforms:
$ for svc in pap pdp pepd; do sudo service argus-$svc restart; done