Excessive resource usage: cpanelconnecttrack

Legin76

• May 23, 2015 13:08

Hi Is this something I need to worry about or should I ignore it? lfd on servername.com: Excessive resource usage: cpanelconnecttrack (7303 (Parent PID:7303)) Time: Sat May 23 06:16:36 2015 +0100 Account: cpanelconnecttrack Resource: Process Time Exceeded: 14453 > 7200 (seconds) Executable: /usr/local/cpanel/3rdparty/sbin/p0f Command Line: /usr/local/cpanel/3rdparty/sbin/p0f -i any -u cpanelconnecttrack -d -s /var/cpanel/userhomes/cpanelconnecttrack/p0f.socket PID: 7303 (Parent PID:7303) Killed: No

• 

  Infopro

  • May 23, 2015 19:15

  Is this something I need to worry about or should I ignore it?

  
  That depends. Have you seen this thread?

  0
• 

  Legin76

  • May 23, 2015 22:28

  Yes but I don't know if the process is harmfull or not. I'm getting the emails every hour. It's up to 75865 > 7200 (seconds) 7303 cpanelco 20 0 13100 5144 4444 S 0.3 0.1 10:32.75 p0f Should I set it to ignore, kill the prosess and / or do I need to investigate more.

  0
• 

  Infopro

  • May 23, 2015 23:54

  Yes but I don't know if the process is harmfull or not.

  
  You should look into it instead of waiting for a forum user to reply to you:

  0
• 

  Legin76

  • May 24, 2015 08:28

  To be honest I'd looked into it by searching for "cpanel p0f" and only found a mention got "Fixed case 188329: Make p0f listen on all interfaces." in the change log from 20-05-15 and restarts the passive OS fingerprinting service from the docs. So I didn't think it was harmful but don't know if it's supposed to be constantly running or if I should lfd set to ignore or if it needs to be fixed. Thanks

  0
• 

  cPanelMichael

  • May 26, 2015 17:05

  Hello, You can configure LFD to ignore that process, as it's a standard process that runs with cPanel. Thank you.

  0
• 

  Legin76

  • May 27, 2015 08:51

  Excellent... Thank you for your help

  0
• 

  jmginer

  • July 17, 2015 19:04

  This process is using around 1 core of CPU usage!!! This is a server with 16 cores, and 1 core usage just for p0f bestpic.es/image/1437160011.png

  0
• 

  mike_

  • July 20, 2015 13:47

  Also seeing 100% of one core utilisation on one of our servers:
  Tasks: 248 total, 2 running, 245 sleeping, 0 stopped, 1 zombie Cpu(s): 6.4%us, 26.1%sy, 0.0%ni, 65.2%id, 1.4%wa, 0.0%hi, 0.0%si, 0.9%st Mem: 8040956k total, 7585432k used, 455524k free, 843692k buffers Swap: 4194300k total, 2578332k used, 1615968k free, 4070868k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 357299 cpanelco 20 0 13660 5644 4444 R 85.8 0.1 4830:21 p0f
  I've disabled p0f until this is resolved

  0
• 

  k2tec

  • July 28, 2015 18:08

  I have one server with whm 11.50.0 (build29) enabled p0f-cpanelsync. Normale usage of 0.3% cpu on the other server with whm 11.50.0 (build27) enabled p0f-cpanelsync Usage of 97-100% I disabled it but no difference.

  0
• 

  Infopro

  • July 29, 2015 01:17

  Please feel free to open a ticket with cPanel Technical Support about this.

  0
• 

  k2tec

  • July 29, 2015 06:26

  Thanks Infopro, I looked this morning to my log and system usage but at this time it is normal. But I will keep watching this server because it was not the first time that p0f used a lot of recource.

  0
• 

  cPanelMichael

  • August 25, 2015 18:03

  Hello :) Internal case CPANEL-699 aims to improve the performance for passive OS fingerprinting: Fixed case CPANEL-699: Avoid p0f watching port 80 and 443 for performance reasons. It's included with cPanel version 11.52, which is currently only available in the "Edge" build tier. Thank you.

  0
• 

  sonicthoughts

  • September 11, 2015 13:49

  Can you tell us what to do when it is taking up as much cpu as mysqld?

  0
• 

  cPanelMichael

  • September 11, 2015 13:51

  Can you tell us what to do when it is taking up as much cpu as mysqld?

  
  You can disable it via "WHM >> Service Configuration >> Service Manager" in the meantime. It's named "Passive OS Fingerprinting Daemon". Thank you.

  0

Please sign in to leave a comment.