[Case 96401] Horde Creating High Server Loads - cpanelhorde user and gs process

Eltawoos

Member
Apr 19, 2014
15
0
1
Cairo
cPanel Access Level
Root Administrator
Hello,
There is an issue we faced in our shared hosting server.
Our server is loaded for more times and we found that user "cpanelho" has utilize the resources by command "gs" .. Could you please advice what is it process and how is it working and what can do on the server?

------------------
cpanelho 20 0 106m 17m 5420 R 99.5 0.1 2092:01 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=800000000 -dAlig
-----------------


Waiting for your reply.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,883
2,256
463
Re: Cpanelho gs process?!

Hello :)

Could you verify which OS is installed on your system?

Code:
cat /etc/redhat-release
Please also post the output from:

Code:
rpm -qa|grep ghostscript
This will help us to determine if your issue is related to an internal case that's open (#96401).

Thank you.
 

markhubert

Member
Jan 7, 2007
8
0
151
Horde Creating High Server Loads - cpanelhorde user and gs process

Trying to figure out the cause and how to stop this high usage of CPU. Any suggestions appreciated.
Code:
Pid	Owner	Priority	CPU %	Memory %	Command
4093	32007	0	  93.4	0.0	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-4092fTXcvajzkDDp%d -f/tmp/magick-40925ZZPz1B6LbJY -f/tmp/magick-40926pXNjYJcYaPx

15491	32007	0	  93.4	0.0	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-15490FowC0eEiVZVI%d -f/tmp/magick-15490cQ7begKoJyOS -f/tmp/magick-15490x2uzBzY6UeH2

32552	32007	0	  88.7	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-32551jAPcpmfPmUIn%d -f/tmp/magick-32551VY2RuHimqju3 -f/tmp/magick-32551WWevl63R80fJ

740	32007	0	  88.3	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-739G9NTn6vD78TO%d -f/tmp/magick-739S46qE2sdCa9i -f/tmp/magick-739kucVUSxdzjoN

32641	32007	0	  88.3	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-32640elUGSXfrmeXH%d -f/tmp/magick-32640eLIK6nLd3BAX -f/tmp/magick-32640DjBI2mv976dd
 

MikeDVB

Well-Known Member
PartnerNOC
Jun 4, 2008
220
6
68
Indiana, USA
I see nothing that indicates Horde - but it does look like ImageMagick processes processing images. Looks like you have a site that relies heavily upon it and that's where your CPU is going.
 

julissax

Registered
Apr 21, 2014
4
0
51
cPanel Access Level
Root Administrator
Re: Cpanelho gs process?!

Hi,

I have the same problem, thanks in advance.

Logs:

nice top
Code:
    PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                           
 285321 cpanelho  25   0  106m  14m 4504 R 99.8  0.0  11:53.67 gs                                                                                                                
 285186 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:56.97 gs                                                                                                                
 285461 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:43.59 gs                                                                                                                
 285472 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:43.22 gs

cat /etc/redhat-release
Code:
CloudLinux Server release 5.10 (Georgy Beregovoy)
rpm -qa|grep ghostscript
Code:
ghostscript-8.70-15.el5_9.3
ghostscript-fonts-5.50-13.1.1

ps aux | grep gs
Code:
32002     285186 99.7  0.0 109288 14488 ?        R    16:37  14:41 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285180uiVhnnXe6IlF%d -f/tmp/magick-285180cu2h8-za8SH0 -f/tmp/magick-2851801krBig31sb4l
32002     285321 99.7  0.0 109288 14488 ?        R    16:37  14:38 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285320YkbQdEUUK0YA%d -f/tmp/magick-285320ERLfgO85c2PO -f/tmp/magick-285320l1YIKYAqx9G2
32002     285461 99.7  0.0 109260 14456 ?        R    16:37  14:28 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285450fEtTHsmeTL2M%d -f/tmp/magick-285450O8yL898p113C -f/tmp/magick-285450tzMYWF0gXq5s
32002     285472 99.8  0.0 109260 14456 ?        R    16:37  14:28 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285470jkhgVhNdsPE2%d -f/tmp/magick-285470ccORqjrJ7iUR -f/tmp/magick-285470WJbjbsV34U9G
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,883
2,256
463
I have merged these threads. To paraphrase internal case 96401:

The issue occurs on CentOS 5 systems when users within Horde take actions (probably related to attachments) that cause processes to consume 100% CPU for very long (likely infinite) periods of time. Ghostscript sees chunks of data it does not understand, but continues to try to process the file and gets itself stuck in an infinite loop which makes no system calls, probably as a result of failed preconditions.

There is currently no specific time frame or estimate on when a resolution might be implemented. The recommended workaround is to manually kill the processes.

Thank you.
 

garconcn

Well-Known Member
Oct 29, 2009
172
18
68
Are you guys using CSF on your cpanel?

I have seen the same problem recently. I found that before CSF report a suspicous process running under user cpanelhorde, it removed a file name like "magick-xxx" from /tmp directory. You can add the cpanelhorde user to file inogre list so that its file won't be removed.
Code:
         # echo 'user:cpanelhorde' >> /etc/csf/csf.fignore
         # csf -q

===CSF Suspicious File Alert===
File:   /tmp/magick-22968H96hov0rpgmD
Reason: Suspicious symlink (->/var/cpanel/userhomes/cpanelhorde/cache/imgGdashL)
Owner:  cpanelhorde:cpanelhorde (32002:32002)
Action: Symlink removed

===Suspicious process running under user cpanelhorde===
Time:    Wed Apr 23 10:52:41 2014 -0700
PID:     22897 (Parent PID:22715)
Account: cpanelhorde
Uptime:  18347 seconds


Executable:

/usr/local/cpanel/3rdparty/php/54/bin/php-cgi


Command Line (often faked in exploits):

/usr/local/cpanel/3rdparty/php/54/bin/php-cgi -c /usr/local/cpanel/3rdparty/php/54/etc/horde /usr/local/cpanel/base/horde/imp/view.php


Network connections by the process (if any):

tcp: 127.0.0.1:47935 -> 127.0.0.1:3306
tcp: 127.0.0.1:47937 -> 127.0.0.1:3306
tcp: 127.0.0.1:49481 -> 127.0.0.1:143


Files open by the process (if any):

/usr/local/cpanel/logs/error_log
/var/cpanel/horde/log/[email protected]
/var/cpanel/userhomes/cpanelhorde/sessions/sess_7nciu8dsuq7nsphq2ju8ag1e27
/var/cpanel/userhomes/cpanelhorde/cache/phpDK61YK


===/usr/local/cpanel/logs/error_log===
identify: `%s' (%d) "gs" -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=pbmraw" -dTextAlphaBits=4 -dGraph
icsAlphaBits=4 "-r72x72" -dUseCIEColor  "-sOutputFile=/tmp/magick-22968mlrHPXRvRQOE-1" "-f/tmp/magick-22968afZur9OAyt5D" "-f/tmp/magick-22968H96hov0rpgmD" @ error/utility
.c/SystemCommand/2036.
identify: Postscript delegate failed `/var/cpanel/userhomes/cpanelhorde/cache/imgGdashL': No such file or directory @ error/pdf.c/ReadPDFImage/682.
PHP Fatal error:  Uncaught exception 'Horde_Imap_Client_Exception' with message 'Mail server closed the connection unexpectedly.' in /usr/local/cpanel/3rdparty/php/54/lib/php/Horde/Imap/Client/Socket/Connection/Socket.php:142
Stack trace:
 
Last edited: