Disk read increased for syscollector test in 4.8.0-beta4

[Rebits]

Wazuh version	Component	Install type	Install method	Platform
4.8.0-beta4	Syscollector	Manager	Packages	centOS 7

Description

During the investigation of #22547, it has been observed that disk reads are occurring across all modules. This behavior appears to have been altered since version 4.8.0 alpha1.

4.8.0	4.7.3

[sebasfalcone]

This test should be repeated in 4.7.3

It is not possible that 0 disk reads were performed:

• Wazuh-db
• Syscollector
• Logcollector

All of those modules should report some disk reads

[Rebits]

I reopened this issue due to the zero disk read behavior does not occur only in 4.7.3 but in all the previous footprint tests:

• 4.7.0
• 4.6.0
• 4.5.3

---

All of those modules should report some disk reads

Logcollector is not enabled in this test. However, the wazuh-db and the syscollector indeed should report disk read. Further research is required

[sebasfalcone]

Hi @Rebits!

Given that 4.8.0 didn't present changes on the syscollector module or the associated configurations, I have a question:

• Did the tests or their configurations change in some way?

[rafabailon]

Update

Hi @sebasfalcone,

I've reviewed the changes in v4.8.0-alpha1 and there doesn't seem to be anything relevant that could have caused the change. The next step is to create a local environment similar to the one used in Footprints and pass the tests (4.7.3) to be able to manually check if there is activity on the disk or not.

[rafabailon]

Update

Hi @sebasfalcone,

I have reviewed the pipeline code again along with the scripts that runs the pipeline. There are some changes in the pipeline but nothing that justifies a change in performance. They are, basically, refactoring. The scripts, for their part, have not changed. The most recent commits are from 7 months ago.

I have tried setting up a local environment with a manager (centos) and an agent (ubuntu). I have run the Footprint scripts and monitored the system resources.

In 4.7.3 there is less activity than in 4.8.0. I have checked the memory usage, CPU usage and disk operations.

4.7.3

4.8.0

In 4.7.3 I have only occasionally seen almost negligible disk read access. In 4.8.0 there is reading and writing activity in addition to the rest of the processes having greater activity. I have also tried increasing the load but the result is the same.

[sebasfalcone]

It won't be possible for us to analyse this issue further, we still believe that is not possible that 0 disk reads are performed over the use of the module, just reading the configuration files should have some impact on this metric

Also, in the images shown we don't see modulesd on the list which is the one required for us to analyse

I will close this issue, please re-open it when comparable metrics of modulesd are obtained

[sebasfalcone]

EDPS are 0 on the tests performed on 4.7.3:

This could explain this behaviour

[rafabailon]

During the footprint Release 4.8.0 - RC 1 - Footprint Metrics - ROOTCHECK (2.5d) I detected an increase in wazuh-syscheckd in the plot Disk_Read. There is also a minimal increase in wazuh-db.

I reopen the issue to investigate the increase and compare the configurations used.

4.8.0-rc1	4.7.4-rc2

[Dwordcito]

@rafabailon This issue is for syscollector, not for syscheck.

Please open another issue for the correct module.