Bugzilla – Bug 1216158
[Build 20231011-1] oscap xccdf eval command stuck in test oscap_xccdf_eval_remote
Last modified: 2024-05-06 12:35:40 UTC
## Observation openQA test in scenario sle-15-SP5-Server-DVD-Updates-s390x-stig@s390x-kvm fails in [oscap_xccdf_eval_remote](https://openqa.suse.de/tests/12463240/modules/oscap_xccdf_eval_remote/steps/42) The command got stuck for 50 minutes (which is the script timeout) in this scenario running in maintenance updates. See logs attached to openQA job in Logs and Assets tab. Script code: https://github.com/search?q=repo%3Aos-autoinst%2Fos-autoinst-distri-opensuse%20oscap_evaluate_remote&type=code ## Expected result Last good: [20231010-1](https://openqa.suse.de/tests/12450777) (or more recent)
It has probably run out of memory again, looking at the follow screen shots it seems in an OOM situation. --fetch-remote-resources will really use multiple gigabytes of memory
Fwiw, in public cloud tests we download the compressed file, uncompress it and then run it with --local-files like this: https://github.com/os-autoinst/os-autoinst-distri-opensuse/blob/master/tests/publiccloud/hardened.pm
Did you see if it reduced memory usage of openscap?
(In reply to Marcus Meissner from comment #3) > Did you see if it reduced memory usage of openscap? I didn't analyze it but at least it worked. It seems to me that oscap was trying to download the whole file which is 350MB because it was taking too much time, or perhaps downloaded the compressed file and tried to uncompress in memory itself.
It succeed with less ram, it was quite overdimensioned, and no idea how guest shared memory in that situation, I set 8GiB to be conservative and the timeout needs to be bumped because in rare ocassion we made in 16' but normally was in the boundary of the timeout of 50'. https://openqa.suse.de/tests/12464688#step/oscap_xccdf_eval_remote/42 So no bug :) thanks for the feedback. we will keep in mind this local option for future development.
I could make it run in cloud with instances with 8G of RAM adding 4G of swap.
I noticed that the installer when does it for you to apply the policies also download it first to apply stig, but then we wouldn't test that option if we don't use the fetch remote option.
Hello Joaquín Because in your message we have: ++ So no bug :) thanks for the feedback. we will keep in mind this local option for future development. ++ may we consider that this bug is closed and to change it status, otherwise we continue to have this bug in our list. Thank you in advance for your feedback. Have a nice day Rumen
I'm closing the bug based on the last comment.
Fwiw, the workaround with swap didn't work sometimes even with 16G RAM. We had to increase our VM's to 32G.