Skip to main content

[Case 96401] Horde Creating High Server Loads - cpanelhorde user and gs process

Eltawoos
Hello, There is an issue we faced in our shared hosting server. Our server is loaded for more times and we found that user "cpanelho" has utilize the resources by command "gs" .. Could you please advice what is it process and how is it working and what can do on the server? ------------------ cpanelho 20 0 106m 17m 5420 R 99.5 0.1 2092:01 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=800000000 -dAlig ----------------- Waiting for your reply.

Comments

8 comments

Date Votes
  • cPanelMichael
    Re: Cpanelho gs process?! Hello :) Could you verify which OS is installed on your system? cat /etc/redhat-release
    Please also post the output from: rpm -qa|grep ghostscript
    This will help us to determine if your issue is related to an internal case that's open (#96401). Thank you.
    0
  • Eltawoos
    Re: Cpanelho gs process?! Yes, I think that's related ghostscript Sys v: Cloudlinux 5.6 How can i check for internal case that's open #96401
    0
  • markhubert
    Horde Creating High Server Loads - cpanelhorde user and gs process Trying to figure out the cause and how to stop this high usage of CPU. Any suggestions appreciated. Pid Owner Priority CPU % Memory % Command 4093 32007 0 93.4 0.0 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-4092fTXcvajzkDDp%d -f/tmp/magick-40925ZZPz1B6LbJY -f/tmp/magick-40926pXNjYJcYaPx 15491 32007 0 93.4 0.0 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-15490FowC0eEiVZVI%d -f/tmp/magick-15490cQ7begKoJyOS -f/tmp/magick-15490x2uzBzY6UeH2 32552 32007 0 88.7 0.3 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-32551jAPcpmfPmUIn%d -f/tmp/magick-32551VY2RuHimqju3 -f/tmp/magick-32551WWevl63R80fJ 740 32007 0 88.3 0.3 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-739G9NTn6vD78TO%d -f/tmp/magick-739S46qE2sdCa9i -f/tmp/magick-739kucVUSxdzjoN 32641 32007 0 88.3 0.3 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-32640elUGSXfrmeXH%d -f/tmp/magick-32640eLIK6nLd3BAX -f/tmp/magick-32640DjBI2mv976dd
    0
  • MikeDVB
    I see nothing that indicates Horde - but it does look like ImageMagick processes processing images. Looks like you have a site that relies heavily upon it and that's where your CPU is going.
    0
  • markhubert
    The user 32007 is cpanelhorde
    0
  • julissax
    Re: Cpanelho gs process?! Hi, I have the same problem, thanks in advance. Logs: nice top PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 285321 cpanelho 25 0 106m 14m 4504 R 99.8 0.0 11:53.67 gs 285186 cpanelho 25 0 106m 14m 4504 R 98.0 0.0 11:56.97 gs 285461 cpanelho 25 0 106m 14m 4504 R 98.0 0.0 11:43.59 gs 285472 cpanelho 25 0 106m 14m 4504 R 98.0 0.0 11:43.22 gs
    cat /etc/redhat-release CloudLinux Server release 5.10 (Georgy Beregovoy)
    rpm -qa|grep ghostscript ghostscript-8.70-15.el5_9.3 ghostscript-fonts-5.50-13.1.1
    ps aux | grep gs 32002 285186 99.7 0.0 109288 14488 ? R 16:37 14:41 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285180uiVhnnXe6IlF%d -f/tmp/magick-285180cu2h8-za8SH0 -f/tmp/magick-2851801krBig31sb4l 32002 285321 99.7 0.0 109288 14488 ? R 16:37 14:38 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285320YkbQdEUUK0YA%d -f/tmp/magick-285320ERLfgO85c2PO -f/tmp/magick-285320l1YIKYAqx9G2 32002 285461 99.7 0.0 109260 14456 ? R 16:37 14:28 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285450fEtTHsmeTL2M%d -f/tmp/magick-285450O8yL898p113C -f/tmp/magick-285450tzMYWF0gXq5s 32002 285472 99.8 0.0 109260 14456 ? R 16:37 14:28 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285470jkhgVhNdsPE2%d -f/tmp/magick-285470ccORqjrJ7iUR -f/tmp/magick-285470WJbjbsV34U9G
    0
  • cPanelMichael
    I have merged these threads. To paraphrase internal case 96401: The issue occurs on CentOS 5 systems when users within Horde take actions (probably related to attachments) that cause processes to consume 100% CPU for very long (likely infinite) periods of time. Ghostscript sees chunks of data it does not understand, but continues to try to process the file and gets itself stuck in an infinite loop which makes no system calls, probably as a result of failed preconditions. There is currently no specific time frame or estimate on when a resolution might be implemented. The recommended workaround is to manually kill the processes. Thank you.
    0
  • garconcn
    Are you guys using CSF on your cpanel? I have seen the same problem recently. I found that before CSF report a suspicous process running under user cpanelhorde, it removed a file name like "magick-xxx" from /tmp directory. You can add the cpanelhorde user to file inogre list so that its file won't be removed. # echo 'user:cpanelhorde' >> /etc/csf/csf.fignore # csf -q ===CSF Suspicious File Alert=== File: /tmp/magick-22968H96hov0rpgmD Reason: Suspicious symlink (->/var/cpanel/userhomes/cpanelhorde/cache/imgGdashL) Owner: cpanelhorde:cpanelhorde (32002:32002) Action: Symlink removed ===Suspicious process running under user cpanelhorde=== Time: Wed Apr 23 10:52:41 2014 -0700 PID: 22897 (Parent PID:22715) Account: cpanelhorde Uptime: 18347 seconds Executable: /usr/local/cpanel/3rdparty/php/54/bin/php-cgi Command Line (often faked in exploits): /usr/local/cpanel/3rdparty/php/54/bin/php-cgi -c /usr/local/cpanel/3rdparty/php/54/etc/horde /usr/local/cpanel/base/horde/imp/view.php Network connections by the process (if any): tcp: 127.0.0.1:47935 -> 127.0.0.1:3306 tcp: 127.0.0.1:47937 -> 127.0.0.1:3306 tcp: 127.0.0.1:49481 -> 127.0.0.1:143 Files open by the process (if any): /usr/local/cpanel/logs/error_log /var/cpanel/horde/log/horde_user@domain.log /var/cpanel/userhomes/cpanelhorde/sessions/sess_7nciu8dsuq7nsphq2ju8ag1e27 /var/cpanel/userhomes/cpanelhorde/cache/phpDK61YK ===/usr/local/cpanel/logs/error_log=== identify: `%s' (%d) "gs" -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=pbmraw" -dTextAlphaBits=4 -dGraph icsAlphaBits=4 "-r72x72" -dUseCIEColor "-sOutputFile=/tmp/magick-22968mlrHPXRvRQOE-1" "-f/tmp/magick-22968afZur9OAyt5D" "-f/tmp/magick-22968H96hov0rpgmD" @ error/utility .c/SystemCommand/2036. identify: Postscript delegate failed `/var/cpanel/userhomes/cpanelhorde/cache/imgGdashL': No such file or directory @ error/pdf.c/ReadPDFImage/682. PHP Fatal error: Uncaught exception 'Horde_Imap_Client_Exception' with message 'Mail server closed the connection unexpectedly.' in /usr/local/cpanel/3rdparty/php/54/lib/php/Horde/Imap/Client/Socket/Connection/Socket.php:142 Stack trace:
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post