emond deamon consuming all cpu and memory

Question

emond deamon consuming all cpu and memory

I installed OS X Leopard server on a new aluminum iMac 20 2 GHz. Every few minutes, the emond process takes over and consumes all the CPU time and the remainder of memory. I have 4 GB installed, and prior to emond running I have 3.2 GB free.

I did a standard install of the server and only have a handful of accounts installed.

How can I configure emond so that it doesn't take over my server? After reading the man page, I don't see any tangible benefit I get from it running.

-ernie

iMac, Mac OS X (10.5.1)

Posted on Dec 29, 2007 8:28 AM

Reply

Answer 1

Dec 30, 2007 6:26 PM in response to ernie.varitimos

There's minimal documentation on emond, but after discovering the location of the rules files, I figured out how to turn off the individual rule entries. I turned off every single one (about 20 or so), and that fixed the CPU utilization and memory hogging. Unfortunately I wasn't able to figure out which rule(s) was/were causing the problem.

The rules are located here:

/etc/emond.d/rules/AdaptiveFirewall.plist
/etc/emond.d/rules/DiskStatus.plist
/etc/emond.d/rules/SWUpdate.plist

It would be helpful if someone could recommend which of these rules should be kept active. I guess that largely depends upon the use of this server. In this case the server is used largely for non-commercial use for 7 personal email accounts. I also use it to host my consulting business email and website, and prototype web applications I'm currently developing, etc.

Reply

Answer 2

Dec 31, 2007 5:31 PM in response to ernie.varitimos

This may be a known issue. Please paste the output of "df -hl" so I can ask better questions.

The rules file names should provide a hint to their purpose:
• adaptive firewall: blocks machines trying to crack your Mac
• disk status: archives logs when disk space gets tight
• SW update: notifies the admin when a new update is available

Reply

Answer 3

Jan 2, 2008 3:55 PM in response to keeperofthecheese

{quote:title=chris, svr mgr, 1 of 5 wrote:}
This may be a known issue. Please paste the output of "df -hl" so I can ask better questions.

The rules file names should provide a hint to their purpose:
• adaptive firewall: blocks machines trying to crack your Mac
• disk status: archives logs when disk space gets tight
• SW update: notifies the admin when a new update is available
{quote}

I appreciate your response, however the names of the config files are intuitive as to their use. My problem is diagnosing the specific rule within one of these configs to determine which was the CPU and memory hog, and which rules, as a matter of best practice, that I should keep enabled.

The man page for emond has minimal information, and the description in the Server documentation was not any more help. Nowhere could I find any information on how processes interact with emond, or specifics on editing the rules.

-ernie

Reply

Answer 4

Jan 2, 2008 4:05 PM in response to ernie.varitimos

{quote:title=ernie.varitimos wrote:}
Please paste the output of "df -hl" so I can ask better questions.{quote}

I don't understand how listing the mounted volumes is relevant to the problem I'm having. Could you explain?

In any case, here it is:

Filesystem Size Used Avail Capacity Mounted on
/dev/disk0s2 233Gi 30Gi 202Gi 14% /
/dev/disk2s3 466Gi 69Gi 396Gi 15% /Volumes/Time Machine

Reply

Answer 5

Jan 7, 2008 6:32 PM in response to ernie.varitimos

Unfortunately, I am generally restricted in the type and amount of information I can provide, which is why my questions may seem odd or irrelevant.

If you rename the volume "TimeMachine" (i.e. no spaces) and reboot, does the problem go away with all rules enabled?

As for the question of documentation, the Leopard release of this feature was intended to be Apple-internal, which is why this (pretty powerful, IMHO) feature is not yet widely used throughout the system.

Reply

Answer 6

David Lee

Level 2

431 points

Jan 18, 2008 1:42 AM in response to keeperofthecheese

Hello,

Sorry to hijack this thread but I may have a similar situation.

I have Leopard Server running on a G4 and I am having issues with it crashing a few times per day.

One of the entries in the system.log file says this:

Jan 18 09:31:02 server emond[107]: Host at 192.168.1.51 will be blocked for at least 15.00 minutes

That IP address is one of our DHCP users and they are only connected via AFP. Could this be a problem for the server? When it says the user has been blocked for 15 minutes does this mean their AFP access will freeze?

Thanks for any advice you can give.

Many thanks,

David

Reply