nGinx shoots 100% CPU

[rvmvsjvm]

we are using
Nginx version 1.12.2
openssl-1.1.0g
Nginx- Modsecurity 3.0
owasp-modsecurity-crs-3.0-master (Core Rule Set)

we are using nginx and the load average is shooting up more than 1 with 2 cores for 50 domains

[victorhora]

Hi,

Can you confirm if you are using the latest codebase for libModSecurity (i.e. current release)

If yes, check if the issue persists with the current the v3/dev/performance branch. This branch has a number of performance improvements which are currently being tested and might help with the issue you're facing.

[nissel]

I've been evaluating libModSecurity and getting poor performance / high cpu load using a build of v3/master and the owasp crs.

Just made a build from v3/dev/performance and it's performing wonderfully.

[Stono]

I've just been seeing this too, 100% cpu usage when enabling CRS on nginx for a single request! Do we know when/if the fixes in v3/dev/performance will make it into master @victorhora ?

[ediezh]

I'm getting the following error with the build from v3/dev/performance branch on centos 7:

nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /usr/local/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf. Line: 169. Column: 390. Invalid variable: MULTIPART_SEMICOLON_MISSING},\ in /etc/nginx/conf.d/default.conf:9
nginx: configuration file /etc/nginx/nginx.conf test failed

nginx: v1.13.0
CRS: v3.0.2

[defanator]

@edieship take a look on this one: SpiderLabs/owasp-modsecurity-crs#995

You should apply the patch from that PR to your CRS.

[ediezh]

@defanator Thanks!

[Stono]

Hey @edieship you might be interested in kubernetes/ingress-nginx#1996 - basically we had this problem on the ingress nginx.

I found a specific version of modsecurity + owasp CRS that worked (check the changed files)

[ediezh]

@Stono , thanks a lot, that works.