False load alerts in LXC containers: the load average is the host's
Monitoring and security alerts were «unbearable». Before touching anything I measured a whole week. 82 % of Zabbix alerts came from a single trigger that doesn't measure what it seems inside a container, and Wazuh was sending thousands of routine sessions.
- Zabbix
- LXC
- Wazuh
Measure before touching
- Zabbix: 178 alerts in 7 days, each arriving twice (email and Discord, both from the lowest severity).
- 82 % were «Load average per CPU above 3 for 15m», opening and closing on several containers at once.
- Wazuh: 9,517 alerts in 7 days to Discord, nearly all level 3: session opens and closes from my own automations, successful SSH and routine checks.
Why the load fired
Inside an LXC container, /proc/loadavg shows the whole server's load, unless lxcfs has been mounted to virtualise it. Reading the host and three containers at the same time gave the same numbers.
The trigger divided that load by each container's 2 CPUs. During the monthly RAID check the host reached a load of 50, so every container «was» at 25 per CPU and eight fired at once.
# on the host and inside a container, at the same time
cat /proc/loadavg
4.08 8.77 35.28 ...
4.08 8.77 35.28 ...The changes
- Load trigger disabled on the containers; it stays only on the hypervisor, where it measures something real. Each container's CPU is still watched by usage.
- Email only for high severity; Discord from average up; the phone room, only high.
- Wazuh to Discord from level 7 (about 106 a week) and email from level 10 (about 15). What stops arriving is still on the dashboard.
- A ghost host from a retired container, disabled (not deleted).