Help - Search - Members - Calendar
Full Version: Tripwire Running Slowly
Linuxhelp > Support > Technical Support
Yesterday when I went to check tripwire on my webserver, it seemed to be taking forever. Every time it runs now, it seems to take around 10 minutes to run. Before yesterday(or last night to be more exact) it would run in around 1 minute.

I have run TOP while it was running, and it does not seem to be taking up much processor or memory, and have not done anything to the system that should slow it down that much. Thought perhaps it was the hard drives, so I check using hdparm.

hdaparm -Tt /dev/hda1 displays this:
Timing buffer-cache reads: 128 MB in 0.67 seconds =191.04 MB/sec
Timing buffered disk reads: 64 MB in 78.57 seconds =834.11 kB/sec

hdaparm -Tt /dev/hda2 displays this:
Timing buffer-cache reads: 128 MB in 0.65 seconds =196.92 MB/sec
Timing buffered disk reads: 64 MB in 6.52 seconds = 9.82 MB/sec

hdaparm -Tt /dev/hda3 displays this:
Timing buffer-cache reads: 128 MB in 0.65 seconds =196.92 MB/sec
Timing buffered disk reads: 64 MB in 3.21 seconds = 19.94 MB/sec

Shouldn't the Timing buffer be faster on hda1?

Any suggestions on this tripwire problem would be much appreciated.
Your hda1 speed is very slow ...

Do you have a partition that is close to 100% full?

Post hdparm -v /dev/hda, hdparm -i /dev/hda, and df results.

Since all the partitions are using the same cable and controller (there all on the same drive) the only thing that makes sense is that there is a lack of space on the drive or a cycling issue ... run the hdparm -Tt /dev/hda1 3 times in a row..
hdparm -v dev/hda
multcount = 16 (on)
IO_support = 0 (default 16-bit)
unmaskirq = 0 (off)
using_dma = 1 (on)
keepsettings = 0 (off)
readonly = 0 (off)
readahead = 8 (on)
geometry = 1661/255/63, sectors = 26684784, start = 0

hdparm -i dev/hda
Model=Maxtor 91366U4, FwRev=RA530JN0, SerialNo=H40EJ2PC
Config={ Fixed }
RawCHS=16383/16/63, TrkSize=0, SectSize=0, ECCbytes=57
BuffType=DualPortCache, BuffSize=2048kB, MaxMultSect=16, MultSect=16
CurCHS=16383/16/63, CurSects=16514064, LBA=yes, LBAsects=26684784
IORDY=on/off, tPIO={min:120,w/IORDY:120}, tDMA={min:120,rec:120}
PIO modes: pio0 pio1 pio2 pio3 pio4
DMA modes: mdma0 mdma1 mdma2
UDMA modes: udma0 udma1 *udma2 udma3 udma4
AdvancedPM=yes: disabled (255) WriteCache=enabled
Drive conforms to: ATA/ATAPI-4 T13 1153D revision 17: 1 2 3 4 5

hdparm -d dev/hda
using_dma = 1 (on)

hdparm -Tt dev/hda
Timing buffer-cache reads: 128 MB in 0.67 seconds =191.04 MB/sec
Timing buffered disk reads: 64 MB in 81.22 seconds =806.89 kB/sec

Timing buffer-cache reads: 128 MB in 0.66 seconds =193.94 MB/sec
Timing buffered disk reads: 64 MB in 53.03 seconds = 1.21 MB/sec

Timing buffer-cache reads: 128 MB in 0.68 seconds =188.24 MB/sec
Timing buffered disk reads: 64 MB in 75.54 seconds =867.57 kB/sec

hda1 is only 50% full.
It is very strange that the hda performance is so slow....
First off ... I didn't ask what OS / version you are running ... and what hdparm version. To check your hdparm version do hdparm -V (it is a capital V)...

you should only try these mods with hdparm version 5.1 and above....and on a kernel that is 2.2 or above. You have to be root to do these mods.

looking at your posts, there are a couple options we can turn on to try and increase performance:
First Item - Drive IDE bus speed.

This line:

UDMA modes: udma0 udma1 *udma2 udma3 udma4

indicates that your hard drive supports udma4, but it is set to udma2 ... that could be a big performance increase. But your motherboard IDE chipset might not support udma4. You can check by running the following command:

hdparm -X68 /dev/hda

The result will be:
setting xfermode to 68 (UltraDMA mode4)

or an error similar to this:

setting xfermode to 68 (UltraDMA mode4)
HDIO_DRIVE_CMD(setxfermode) failed: Input/output error

If you got an error, use the command hdparm -X66 /dev/hda to switch back to udma2 mode...
Next Item - Query/enable (E)IDE 32-bit I/O support:
The line:

IO_support = 0 (default 16-bit)

indicates you are using a (E)IDE 16-bit I/O mode. You should be able to use the (E)IDE 32-bit I/O and increase your speed. Use the command:

hdparm -c1 /dev/hda

It should say:
setting 32-bit IO_support flag to 1
IO_support = 1 (32-bit)

If you get any errors, set the option back to 0 with this command:

hdparm -c0 /dev/hda
Next item - Get/set interrupt-unmask flag

The line:

unmaskirq = 0 (off)

indicates that you have Get/set interrupt-unmask flag turned off ... this can have a negative impact on performance ... but this one is slightly more dangerous than the is the man page for this option:

-u Get/set interrupt-unmask flag for the drive. A setting of 1 permits the driver to unmask other interrupts during processing of a disk interrupt, which greatly improves Linux’s responsiveness and eliminates "serial port overrun" errors. Use this feature with caution: some drive/controller combinations do not tolerate the increased I/O latencies possible when this feature is enabled, resulting in massive filesystem corruption. In particular, CMD-640B and RZ1000 (E)IDE interfaces can be unreliable (due to a hardware flaw) when this option is used with kernel versions earlier than 2.0.13. Disabling the IDE prefetch feature of these interfaces (usually a BIOS/CMOS setting) provides a safe fix for the problem for use with earlier kernels.

That said, I have used this option on more than 30 machines with no problems ... BUT it is possible.

You can check your controller using the command:

lspci | grep IDE

I wouldn't use the -u option if I had either CMD-640B and RZ1000, reguardless of my kernel...

OK now the command to use to enable Get/set interrupt-unmask flag:

hdparm -u1 /dev/hda

it should say this:

setting unmaskirq to 1 (on)
unmaskirq = 1 (on)

If there are any errors, turn the option off using hdparm -u0 /dev/hda.
You already have use_dma, a read ahead buffer, and multiple sector I/O set (the -d1, -a8 and -m16 switches for hdparm)...

You would have to manually set these options on every startup ... I have created a script ... I call it drive_parms and keep it in /etc/init.d so it can start on create this file, do the following:

echo "hdparm -m16 -c1 -d1 -a8 -u1 -X68 /dev/hda" > /etc/init.d/drive_parms
(substitute any values that didn't work for you ... i.e. use X66 if X68 didn't work, or u0 if u1 didn't work, etc.)

then make the script executable with the command:
chmod 755 /etc/init.d/drive_parms

How to make it start when you startup depends on your distro .... but you can make the adjustments manually by using this command:


Did what you said, did not like the mode4. Still runs slow. I freeed up 10% more space, didn't help.

It only seems to be something with hda1, hda2 and hda3 as you can see from the first post run fine. hdb1 (running on same chain) runs just as fast as hda2 and hda3.

I am running RH8 with kernel 2.4.20-19.8.

Something I just thought about, with the upgrade of the last kernel, I am getting way more 'i8253 count too high! resetting..' errors. Because it is allway writting to the message log, could this be whats slowing it dow? I think if I update my BIOS it should take care of this.

Thanks for your help
I see this error on the web ... but I don't see a fix....That might be the problem, others are saying it slowed down their machine.
Thats not the problem. I forced my computer to do a fsck check, and now it runs fine. Thanks for your help.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2017 Invision Power Services, Inc.