lfd excessive processes running under user

ContinuIT

• April 26, 2019 10:54

I have looked at the few threads regarding this error and none seem to apply to my case Related or unrelated, I started getting the errors for one user: User:lochhavenclubinc PID:8483 PPID:8335 Run Time:3(secs) Memory:309316(kb) RSS:42040(kb) exe:/opt/cpanel/ea-php72/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php72/root/usr/bin/php-cgi and at the same time services like mysql, nameserver, clamd, spamd etc, failing and recovering. Service check output looks like this (XID 4jptke) The "clamd" service is down. The subprocess "/usr/local/cpanel/scripts/restartsrv_clamd" reported error number 3 when it ended. It all stopped at around 3 AM. This is not the first time this happens, last time we had to suspend the user (which is actually us) and that stopped the issue. The website for this user is a wordpress site, fully updated and working normally. I am guessing we are being attacked some how, but that is just a wild guess. Any ideas?

• 

  sparek-3

  • April 26, 2019 16:05

  How many WordPress plugins do you have installed? My best guess is that something within wp-cron is running overnight and is overloading your server. Unfortunately, I do not know what that something might be.

  0
• 

  ContinuIT

  • April 26, 2019 16:11

  I have just 13 plugins running, not a lot for a wordpress site. Is there a log of the wp-cron somewhere?

  0
• 

  cPanelLauren

  • April 26, 2019 19:41

  Hi @ContinuIT

  User:lochhavenclubinc PID:8483 PPID:8335 Run Time:3(secs) Memory:309316(kb) RSS:42040(kb) exe:/opt/cpanel/ea-php72/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php72/root/usr/bin/php-cgi

  
  What is the exact excessive error that is associated with this when CSF sends the notification? Is it excessive processes?

  and at the same time services like mysql, nameserver, clamd, spamd etc, failing and recovering. Service check output looks like this

  
  This sounds a lot like something on the account in question here is consuming too many resources. You might check the daily process log if you're viewing the situation after the fact, it can be found at WHM>>Server Status>>Daily Process Log You may also want to take a look at the post here: Tutorial - Troubleshooting high server loads on Linux servers

  0
• 

  sparek-3

  • April 26, 2019 20:00

  The only way I know of to list wp-cron events is through wp-cli wp cron event list | WordPress Developer Resources It's just a guess on my part that it is something to do with wp-cron. You may have something trying to perform a backup at that time and it's consuming all of the memory. But I really don't know.

  0
• 

  ContinuIT

  • April 30, 2019 13:57

  Well, it stopped doing it. This has happened in the past as well, we get the issue going for 2 days and then it stop and we don't know what we did or if it was even us that fixed it.

  0

Please sign in to leave a comment.