<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>One other suggestion – run it in inetd mode. This is MUCH simpler, stunnel will not have to do as much forking and managing and so forth. The O/S will do all that. I know – it is a little less efficient. However, I have found on modern Centos and AIX computers that even with very high volumes it makes no measurable difference. If nothing else, it is another debugging technique. Especially if the runaway process is the parent process … because that does not exist under inetd mode.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Eric<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> stunnel-users [mailto:stunnel-users-bounces@stunnel.org] <b>On Behalf Of </b>Murrey, Brian J.<br><b>Sent:</b> Wednesday, October 17, 2018 11:09 AM<br><b>To:</b> stunnel-users@stunnel.org<br><b>Subject:</b> Re: [stunnel-users] CPU 100%<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We have one service, connecting stunnel to another application. Relevant configuration:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>[vpn]<o:p></o:p></p><p class=MsoNormal>client = no<o:p></o:p></p><p class=MsoNormal>accept = 172.17.102.122:443<o:p></o:p></p><p class=MsoNormal>exec = /usr/sbin/ppp<o:p></o:p></p><p class=MsoNormal>execargs = ppp -direct vpn<o:p></o:p></p><p class=MsoNormal>pty = yes<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Brian<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Vincent Deschenes <<a href="mailto:vdeschenes@stelvio.com">vdeschenes@stelvio.com</a>> <br><b>Sent:</b> Wednesday, October 17, 2018 2:05 PM<br><b>To:</b> Murrey, Brian J. <<a href="mailto:Brian.Murrey@trimedx.com">Brian.Murrey@trimedx.com</a>>; <a href="mailto:stunnel-users@stunnel.org">stunnel-users@stunnel.org</a><br><b>Subject:</b> RE: [stunnel-users] CPU 100%<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-CA>Just a silly idea, but is it possible you have a re-entrant configuration for one service, one that connect back to itself creating a loop?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><div><p class=MsoNormal><span lang=EN-CA style='font-family:"Courier New"'>Vincent Deschenes Ing. PMP<o:p></o:p></span></p></div><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> stunnel-users <<a href="mailto:stunnel-users-bounces@stunnel.org">stunnel-users-bounces@stunnel.org</a>> <b>On Behalf Of </b>Murrey, Brian J.<br><b>Sent:</b> Wednesday, 17 October 2018 1:57 PM<br><b>To:</b> <a href="mailto:stunnel-users@stunnel.org">stunnel-users@stunnel.org</a><br><b>Subject:</b> [stunnel-users] CPU 100%<o:p></o:p></p></div></div><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><p class=MsoNormal>We are running stunnel 5.49 on FreeBSD 11.2 and we’re running into a problem once in a while. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>CPU pegs at 100% when we get an stunnel connection from one of our external devices. <o:p></o:p></p><p class=MsoNormal>This affects 100% of all cores and we can’t even log in to console.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It doesn’t happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Have any of you run in to this issue? <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Sincerely, <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Brian Murrey<br>System Engineer II, IT Infrastructure<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="100%" align=center></div><p><b><span style='font-size:10.0pt;color:#CCCCCC'>NOTICE:</span></b><span style='font-size:10.0pt;color:#CCCCCC'> This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates.<br><br><b>WARNING:</b> The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.</span><span style='font-size:10.0pt'> <o:p></o:p></span></p><div class=MsoNormal align=center style='text-align:center'><span lang=EN-AU><hr size=2 width="100%" align=center></span></div><p><span lang=EN-AU style='font-size:10.0pt;color:red'>CAUTION: This email originated from outside of the organization. Do not open links or attachments you were not expecting, even from known senders, and use caution when responding. Please contact the Service Desk if in doubt regarding the legitimacy of this email.<o:p></o:p></span></p><div class=MsoNormal align=center style='text-align:center'><span style='font-size:12.0pt;font-family:"Times New Roman",serif'><hr size=3 width="100%" align=center></span></div><p><b><span style='font-size:10.0pt;color:#CCCCCC'>NOTICE:</span></b><span style='font-size:10.0pt;color:#CCCCCC'> This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates.<br><br><b>WARNING:</b> The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.</span><span style='font-size:10.0pt'> <o:p></o:p></span></p></div></body></html>