Skip to main content

rpcbind - lfd excessive resource email

SJR
Could be coincidental, but lfd excessive resource email started at the same time cPanel updated to 110.0.1 today. lfd on vps2.aps123.com: Excessive resource usage: rpc (676 (Parent PID:676)) Time: Tue Apr 4 16:35:31 2023 -0600 Account: rpc Resource: Process Time Exceeded: 19867 > 1800 (seconds) Executable: /usr/bin/rpcbind Command Line: /usr/bin/rpcbind -w -f PID: 676 (Parent PID:676) Killed: No Email comes every hour. Any ideas what this is and if I need it?

Comments

7 comments

Date Votes
  • mtindor
    Could be coincidental, but lfd excessive resource email started at the same time cPanel updated to 110.0.1 today. lfd on vps2.aps123.com: Excessive resource usage: rpc (676 (Parent PID:676)) Time: Tue Apr 4 16:35:31 2023 -0600 Account: rpc Resource: Process Time Exceeded: 19867 > 1800 (seconds) Executable: /usr/bin/rpcbind Command Line: /usr/bin/rpcbind -w -f PID: 676 (Parent PID:676) Killed: No Email comes every hour. Any ideas what this is and if I need it?

    I updated to 110 and rpcbind was installed as well. As part of the typical update, any outstanding packages (RPMs on an RHEL-based system) are updated before WHM is updated. So I don't know if, in my case, it was due to some Cloudlinux package updates that required rpcbind or if it was actually the WHM update itself that required rpcbind. I have never had rpcbind running on any server before and am not really happy that it's running. But it did happen as a result of updating to 110, whether directly as a WHM requirement or indirectly as a CloudLInux package update requirement. I would say you need it (because either WHM or some CloudLinux update required it. This was installed at the time my WHM was updated to 110 (but may not have been because of WHM but rather pending CloudLinux package updates being available): 2023-04-04T09:44:11-0400 SUBDEBUG Installed: rpcbind-1.2.5-10.el8.x86_64 2023-04-04T09:44:12-0400 SUBDEBUG Installed: python3-pyyaml-3.12-12.el8.x86_64 2023-04-04T09:44:12-0400 SUBDEBUG Installed: keyutils-1.5.10-9.el8.x86_64 2023-04-04T09:44:12-0400 SUBDEBUG Installed: libev-4.24-6.el8.x86_64 2023-04-04T09:44:12-0400 SUBDEBUG Installed: libverto-libev-0.3.2-2.el8.x86_64 2023-04-04T09:44:12-0400 SUBDEBUG Installed: gssproxy-0.8.0-21.el8.x86_64 2023-04-04T09:44:12-0400 SUBDEBUG Installed: nfs-utils-1:2.3.3-57.el8_7.1.x86_64 NOTE: The above were Installed, not Upgraded. So they were not installed before 4/4/2023. My guess is one of those packages had all of the other listed packages as dependencies, and so all of those packages were installed. Then, later on in the day: 2023-04-04T17:25:55-0400 DEBUG --> Starting dependency resolution 2023-04-04T17:25:55-0400 DEBUG --> Finding unneeded leftover dependencies 2023-04-04T17:25:56-0400 DEBUG ---> Package gssproxy.x86_64 0.8.0-21.el8 will be erased 2023-04-04T17:25:56-0400 DEBUG ---> Package keyutils.x86_64 1.5.10-9.el8 will be erased 2023-04-04T17:25:56-0400 DEBUG ---> Package libev.x86_64 4.24-6.el8 will be erased 2023-04-04T17:25:56-0400 DEBUG ---> Package libverto-libev.x86_64 0.3.2-2.el8 will be erased 2023-04-04T17:25:56-0400 DEBUG ---> Package nfs-utils.x86_64 1:2.3.3-57.el8_7.1 will be erased 2023-04-04T17:25:56-0400 DEBUG ---> Package python3-pyyaml.x86_64 3.12-12.el8 will be erased 2023-04-04T17:25:56-0400 DEBUG ---> Package rpcbind.x86_64 1.2.5-10.el8 will be erased 2023-04-04T17:25:56-0400 DEBUG --> Finished dependency resolution 2023-04-04T17:25:56-0400 DDEBUG timer: depsolve: 45 ms 2023-04-04T17:25:56-0400 INFO Dependencies resolved. 2023-04-04T17:25:56-0400 INFO ==================================================================================================================================== Package Architecture Version Repository Size ==================================================================================================================================== Removing: ESC[31mrpcbind ESC[m^O x86_64 1.2.5-10.el8 @baseos 108 k Removing dependent packages: ESC[31mnfs-utils ESC[m^O x86_64 1:2.3.3-57.el8_7.1 @baseos 1.6 M Removing unused dependencies: ESC[31mgssproxy ESC[m^O x86_64 0.8.0-21.el8 @baseos 263 k ESC[31mkeyutils ESC[m^O x86_64 1.5.10-9.el8 @baseos 118 k ESC[31mlibev ESC[m^O x86_64 4.24-6.el8 @appstream 99 k ESC[31mlibverto-libev ESC[m^O x86_64 0.3.2-2.el8 @appstream 12 k ESC[31mpython3-pyyaml ESC[m^O x86_64 3.12-12.el8 @baseos 635 k Transaction Summary ==================================================================================================================================== Remove 7 Packages 2023-04-04T17:25:56-0400 INFO Freed space: 2.8 M 2023-04-04T17:26:10-0400 ERROR Operation aborted. 2023-04-04T17:26:10-0400 DDEBUG Cleaning up. So later in the day, some process tried to remove some items that were installed (including rpcbind) but then failed with ERROR Operation aborted. If you happen to be running CloudLinux, then i'd say it was Cloudlinux that installed it (and I question whether it should be uninstalled). If you aren't running CloudLinux then it must have been WHM requiring the update. m
    0
  • mtindor
    Looks like the WHM 110 specifically wanted to install nfs-utils, and as part of that there were some dependencies (including rpcbind). [2023-04-04 09:44:07 -0400] Running version '11.110.0.1' of updatenow. [2023-04-04 09:44:07 -0400] Detected version '11.108.0.15' from version file. [2023-04-04 09:44:07 -0400] --force passed on command line. Upgrade will disregard update config settings. [2023-04-04 09:44:07 -0400] Target version set to '11.110.0.1' [2023-04-04 09:44:07 -0400] Checking license [2023-04-04 09:44:07 -0400] License file check complete [2023-04-04 09:44:07 -0400] glibc-2.28-211.el8.x86_64 [2023-04-04 09:44:07 -0400] Testing if rpm_is_working RPM is installed [2023-04-04 09:44:07 -0400] Testing if it's possible to install a simple RPM [2023-04-04 09:44:07 -0400] Verifying... ######################################## [2023-04-04 09:44:07 -0400] Preparing... ######################################## [2023-04-04 09:44:07 -0400] Updating / installing... [2023-04-04 09:44:07 -0400] rpm_is_working-1.0-0 ######################################## [2023-04-04 09:44:07 -0400] Ensuring required distro packages are installed. [2023-04-04 09:44:07 -0400] Staging 11.110.0.1 cpanelsync files prior to updating /usr/local/cpanel [2023-04-04 09:44:07 -0400] Staging cpanel changes [2023-04-04 09:44:07 -0400] Retrieving and staging /cpanelsync/11.110.0.1/binaries/linux-c8-x86_64/.cpanelsync.bz2 [2023-04-04 09:44:07 -0400] Using mirror '185.125.185.32' for host 'httpupdate.cpanel.net'. [2023-04-04 09:44:07 -0400] Successfully verified signature for cpanel (key types: release). [2023-04-04 09:44:07 -0400] Retrieving and staging /cpanelsync/11.110.0.1/cpanel/.cpanelsync.bz2 [2023-04-04 09:44:07 -0400] checkyum version 22.3 (excludes: bind-chroot) [2023-04-04 09:44:07 -0400] Successfully verified signature for cpanel (key types: release). [2023-04-04 09:44:07 -0400] Maximum sync children set to 16 based on 20219M available memory. [2023-04-04 09:44:07 -0400] Staging files for binaries/linux-c8-x86_64 [2023-04-04 09:44:07 -0400] checkyum version 22.3 (excludes: bind-chroot kernel) [2023-04-04 09:44:07 -0400] Starting yum execution "--assumeyes --color=never --config /etc/yum.conf install nfs-utils --enablerepo=cloudlinux-PowerTools --enablerepo=epel"". [2023-04-04 09:44:08 -0400] This system is receiving updates from CloudLinux Network server. [2023-04-04 09:44:09 -0400] AlmaLinux 8.7 - PowerTools 4.5 MB/s | 3.1 MB 00:00 [2023-04-04 09:44:09 -0400] Last metadata expiration check: 0:00:01 ago on Tue Apr 4 09:44:08 2023. [2023-04-04 09:44:10 -0400] Dependencies resolved. [2023-04-04 09:44:10 -0400] ================================================================================ [2023-04-04 09:44:10 -0400] Package Arch Version Repository Size [2023-04-04 09:44:10 -0400] ================================================================================ [2023-04-04 09:44:10 -0400] Installing: [2023-04-04 09:44:10 -0400] nfs-utils x86_64 1:2.3.3-57.el8_7.1 baseos 514 k [2023-04-04 09:44:10 -0400] Installing dependencies: [2023-04-04 09:44:10 -0400] gssproxy x86_64 0.8.0-21.el8 baseos 118 k [2023-04-04 09:44:10 -0400] keyutils x86_64 1.5.10-9.el8 baseos 65 k [2023-04-04 09:44:10 -0400] libev x86_64 4.24-6.el8 appstream 52 k [2023-04-04 09:44:10 -0400] libverto-libev x86_64 0.3.2-2.el8 appstream 15 k [2023-04-04 09:44:10 -0400] python3-pyyaml x86_64 3.12-12.el8 baseos 193 k [2023-04-04 09:44:10 -0400] rpcbind x86_64 1.2.5-10.el8 baseos 69 k [2023-04-04 09:44:10 -0400] [2023-04-04 09:44:10 -0400] Transaction Summary [2023-04-04 09:44:10 -0400] ================================================================================ [2023-04-04 09:44:10 -0400] Install 7 Packages
    0
  • quietFinn
    Maybe you need it installed, but (most likely) you don't need it running, so: /bin/systemctl stop rpcbind /bin/systemctl disable rpcbind
    0
  • cPRex Jurassic Moderator
    And to add further clarification on this, if it is running, it will break the 1800 second default time that CSF/LFD sets up. That's a setting in their tool and not cPanel, so you could also disable whitelist that process in CSF/LFD. More details on this can be found here -
    0
  • rambillo

    More details can be found where?

    0
  • cPRex Jurassic Moderator

    rambillo - more details on their product can be found here - https://support.configserver.com/en/knowledgebase/category/support

    0
  • rambillo

    cPRex appreciate it.

    https://download.configserver.com/csf/readme.txt is their documentation link currently, and clarifies a lot.

    We're planning to add the following to our /etc/csf/csf.pignore

    exe:/usr/bin/rpcbind

     

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post