Enable IRQ Balance (irqbalance)

An XCCDF Rule

Description

The irqbalance service optimizes the balance between power savings and performance through distribution of hardware interrupts across multiple processors. The irqbalance service can be enabled with the following command:

$ sudo systemctl enable irqbalance.service

Rationale

In an environment with multiple processors (now common), the irqbalance service provides potential speedups for handling interrupt requests.

ID: xccdf_org.ssgproject.content_rule_service_irqbalance_enabled
Severity: Low
References: 11 14 3 9

BAI10.01 BAI10.02 BAI10.03 BAI10.05 DSS05.02 DSS05.05 DSS06.06

4.3.3.5.1 4.3.3.5.2 4.3.3.5.3 4.3.3.5.4 4.3.3.5.5 4.3.3.5.6 4.3.3.5.7 4.3.3.5.8 4.3.3.6.1 4.3.3.6.2 4.3.3.6.3 4.3.3.6.4 4.3.3.6.5 4.3.3.6.6 4.3.3.6.7 4.3.3.6.8 4.3.3.6.9 4.3.3.7.1 4.3.3.7.2 4.3.3.7.3 4.3.3.7.4 4.3.4.3.2 4.3.4.3.3

SR 1.1 SR 1.10 SR 1.11 SR 1.12 SR 1.13 SR 1.2 SR 1.3 SR 1.4 SR 1.5 SR 1.6 SR 1.7 SR 1.8 SR 1.9 SR 2.1 SR 2.2 SR 2.3 SR 2.4 SR 2.5 SR 2.6 SR 2.7 SR 7.6

A.12.1.2 A.12.5.1 A.12.6.2 A.14.2.2 A.14.2.3 A.14.2.4 A.9.1.2

CM-6(a) CM-7(a) CM-7(b)

PR.IP-1 PR.PT-3
Updated: about 1 year ago


[customizations.services]
enabled = ["irqbalance"]

- name: Enable service irqbalance
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto
  - name: Enable service irqbalance
    systemd:
      name: irqbalance
      enabled: 'yes'
      state: started
      masked: 'no'
    when:
    - '"irqbalance" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - enable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_irqbalance_enabled

include enable_irqbalance

class enable_irqbalance {
  service {'irqbalance':
    enable => true,
    ensure => 'running',  }
}

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'irqbalance.service'
"$SYSTEMCTL_EXEC" start 'irqbalance.service'"$SYSTEMCTL_EXEC" enable 'irqbalance.service'

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Enable IRQ Balance (irqbalance)

Description

Rationale

Remediation - OS Build Blueprint

Remediation - Ansible

Remediation - Puppet

Remediation - Shell Script