Enable IRQ Balance (irqbalance)

An XCCDF Rule

Description

The irqbalance service optimizes the balance between power savings and performance through distribution of hardware interrupts across multiple processors. The irqbalance service can be enabled with the following command:

$ sudo systemctl enable irqbalance.service

Rationale

In an environment with multiple processors (now common), the irqbalance service provides potential speedups for handling interrupt requests.

ID: xccdf_org.ssgproject.content_rule_service_irqbalance_enabled
Severity: Low
References: 11 14 3 9

BAI10.01 BAI10.02 BAI10.03 BAI10.05 DSS05.02 DSS05.05 DSS06.06

4.3.3.5.1 4.3.3.5.2 4.3.3.5.3 4.3.3.5.4 4.3.3.5.5 4.3.3.5.6 4.3.3.5.7 4.3.3.5.8 4.3.3.6.1 4.3.3.6.2 4.3.3.6.3 4.3.3.6.4 4.3.3.6.5 4.3.3.6.6 4.3.3.6.7 4.3.3.6.8 4.3.3.6.9 4.3.3.7.1 4.3.3.7.2 4.3.3.7.3 4.3.3.7.4 4.3.4.3.2 4.3.4.3.3

SR 1.1 SR 1.10 SR 1.11 SR 1.12 SR 1.13 SR 1.2 SR 1.3 SR 1.4 SR 1.5 SR 1.6 SR 1.7 SR 1.8 SR 1.9 SR 2.1 SR 2.2 SR 2.3 SR 2.4 SR 2.5 SR 2.6 SR 2.7 SR 7.6

A.12.1.2 A.12.5.1 A.12.6.2 A.14.2.2 A.14.2.3 A.14.2.4 A.9.1.2

CM-6(a) CM-7(a) CM-7(b)

PR.IP-1 PR.PT-3
Updated: over 1 year ago

Remediation Templates

[customizations.services]
enabled = ["irqbalance"]

- name: Enable service irqbalance
  block:
  - name: Gather the package facts
    package_facts:
      manager: auto
  - name: Enable service irqbalance
    systemd:
      name: irqbalance
      enabled: 'yes'
      state: started
      masked: 'no'
    when:
    - '"irqbalance" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - enable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_irqbalance_enabled

include enable_irqbalance
class enable_irqbalance {
  service {'irqbalance':
    enable => true,
    ensure => 'running',
  }
}

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'irqbalance.service'
"$SYSTEMCTL_EXEC" start 'irqbalance.service'
"$SYSTEMCTL_EXEC" enable 'irqbalance.service'
else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Enable IRQ Balance (irqbalance)

Description

Rationale

Remediation Templates

OS Build Blueprint

An Ansible Snippet

A Puppet Snippet

A Shell Script