Remoted process at 100% of CPU usage in a Wazuh master node without agents

[QU3B1M]

Target version	Related issue	Related PR/dev branch
4.5	#14733	In Progress

Description

This change should fix a remoted performance issue where when the cluster has a lot of multigroups configured the cluster synchronization consumes a lot of CPU taking a lot of time to finish

Configurations

Proposed test cases

• The cluster syncronization does not makes the nodes CPU collapse

  Tier 1 test cases

  • No node cpu should collapse after the master node restart with 200 multigroups

    1. Install and setup a wazuh cluster of one master and two workers

    /var/ossec/bin/cluster_control -l
    
    NAME     TYPE    VERSION  ADDRESS        
    master   master  4.3.8    192.168.56.10  
    worker2  worker  4.3.8    192.168.56.12  
    worker1  worker  4.3.8    192.168.56.11  
    

    2. Check the system cpu usage of every node
    3. Add 3 agents and 7 groups and permute to get 200 multigroups

    It could be done adding the registres to the db itself sqlite3 /var/ossec/queue/db/global.db tables: agent, group, belongs

    4. Restart the master node

    /var/ossec/bin/wazuh-control restart
    

    5. Check the system cpu usage of every node is not too high

    It depends of the machine cpu, but it should not be at 100% usage

  • No node cpu should collapse after update a file in each group having 200 multigroups

    1. Install and setup a wazuh cluster of one master and two workers

    /var/ossec/bin/cluster_control -l
    
    NAME     TYPE    VERSION  ADDRESS        
    master   master  4.3.8    192.168.56.10  
    worker2  worker  4.3.8    192.168.56.12  
    worker1  worker  4.3.8    192.168.56.11  
    

    2. Check the system cpu usage of every node
    3. Add 3 agents and 7 groups and permute to get 200 multigroups

    It could be done adding the registres to the db itself sqlite3 /var/ossec/queue/db/global.db tables: agent, group, belongs

    4. Add a new file in each group directory

    echo "testing" > /var/ossec/etc/shared/<groupName>/<fileName>.txt
    

    5. Check the system cpu usage of every node is not at 100% usage (it can take up to 10 seconds to update)
  Tier 2 test cases

  • No node cpu should collapse after a worker restart with 200 multigroups

    1. Install and setup a wazuh cluster of one master and two workers

    /var/ossec/bin/cluster_control -l
    
    NAME     TYPE    VERSION  ADDRESS        
    master   master  4.3.8    192.168.56.10  
    worker2  worker  4.3.8    192.168.56.12  
    worker1  worker  4.3.8    192.168.56.11  
    

    2. Check the system cpu usage of every node
    3. Add 3 agents and 7 groups and permute to get 200 multigroups

    It could be done adding the registres to the db itself sqlite3 /var/ossec/queue/db/global.db tables: agent, group, belongs

    4. Restart a worker node

    /var/ossec/bin/wazuh-control restart
    

    5. Check the system cpu usage of every node is the same than before

    It may have variations, but it should not be high

  • No node cpu should collapse after the master node restart with 300 multigroups

    1. Install and setup a wazuh cluster of one master and two workers

    /var/ossec/bin/cluster_control -l
    
    NAME     TYPE    VERSION  ADDRESS        
    master   master  4.3.8    192.168.56.10  
    worker2  worker  4.3.8    192.168.56.12  
    worker1  worker  4.3.8    192.168.56.11  
    

    2. Check the system cpu usage of every node
    3. Add 3 agents and 7 groups and permute to get 300 multigroups

    It could be done adding the registres to the db itself sqlite3 /var/ossec/queue/db/global.db tables: agent, group, belongs

    4. Restart the master node

    /var/ossec/bin/wazuh-control restart
    

    5. Check the system cpu usage of every node is not too high

    It depends of the machine cpu, but it should not be at 100% usage

  • No node cpu should collapse after the master node restart with 400 multigroups

    1. Install and setup a wazuh cluster of one master and two workers

    /var/ossec/bin/cluster_control -l
    
    NAME     TYPE    VERSION  ADDRESS        
    master   master  4.3.8    192.168.56.10  
    worker2  worker  4.3.8    192.168.56.12  
    worker1  worker  4.3.8    192.168.56.11  
    

    2. Check the system cpu usage of every node
    3. Add 3 agents and 7 groups and permute to get 400 multigroups

    It could be done adding the registres to the db itself sqlite3 /var/ossec/queue/db/global.db tables: agent, group, belongs

    4. Restart the master node

    /var/ossec/bin/wazuh-control restart
    

    5. Check the system cpu usage of every node is not too high

    It depends of the machine cpu, but it should not be at 100% usage

Considerations