[Case 96401] Horde Creating High Server Loads - cpanelhorde user and gs process

[Eltawoos]

Hello,
There is an issue we faced in our shared hosting server.
Our server is loaded for more times and we found that user "cpanelho" has utilize the resources by command "gs" .. Could you please advice what is it process and how is it working and what can do on the server?

------------------
cpanelho 20 0 106m 17m 5420 R 99.5 0.1 2092:01 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=800000000 -dAlig
-----------------


Waiting for your reply.

 

[cPanelMichael]

Re: Cpanelho gs process?!

Hello

Could you verify which OS is installed on your system?

cat /etc/redhat-release

Please also post the output from:

rpm -qa|grep ghostscript

This will help us to determine if your issue is related to an internal case that's open (#96401).

Thank you.

 

[Eltawoos]

Re: Cpanelho gs process?!

Yes, I think that's related ghostscript
Sys v: Cloudlinux 5.6
How can i check for internal case that's open #96401

 

[markhubert]

Horde Creating High Server Loads - cpanelhorde user and gs process

Trying to figure out the cause and how to stop this high usage of CPU. Any suggestions appreciated.

Pid	Owner	Priority	CPU %	Memory %	Command
4093	32007	0	  93.4	0.0	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-4092fTXcvajzkDDp%d -f/tmp/magick-40925ZZPz1B6LbJY -f/tmp/magick-40926pXNjYJcYaPx

15491	32007	0	  93.4	0.0	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-15490FowC0eEiVZVI%d -f/tmp/magick-15490cQ7begKoJyOS -f/tmp/magick-15490x2uzBzY6UeH2

32552	32007	0	  88.7	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-32551jAPcpmfPmUIn%d -f/tmp/magick-32551VY2RuHimqju3 -f/tmp/magick-32551WWevl63R80fJ

740	32007	0	  88.3	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-739G9NTn6vD78TO%d -f/tmp/magick-739S46qE2sdCa9i -f/tmp/magick-739kucVUSxdzjoN

32641	32007	0	  88.3	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-32640elUGSXfrmeXH%d -f/tmp/magick-32640eLIK6nLd3BAX -f/tmp/magick-32640DjBI2mv976dd

 

[MikeDVB]

I see nothing that indicates Horde - but it does look like ImageMagick processes processing images. Looks like you have a site that relies heavily upon it and that's where your CPU is going.

 

[markhubert]

The user 32007 is cpanelhorde

 

[julissax]

Re: Cpanelho gs process?!

Hi,

I have the same problem, thanks in advance.

Logs:

nice top

    PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                           
 285321 cpanelho  25   0  106m  14m 4504 R 99.8  0.0  11:53.67 gs                                                                                                                
 285186 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:56.97 gs                                                                                                                
 285461 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:43.59 gs                                                                                                                
 285472 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:43.22 gs

cat /etc/redhat-release

CloudLinux Server release 5.10 (Georgy Beregovoy)

rpm -qa|grep ghostscript

ghostscript-8.70-15.el5_9.3
ghostscript-fonts-5.50-13.1.1

ps aux | grep gs

32002     285186 99.7  0.0 109288 14488 ?        R    16:37  14:41 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285180uiVhnnXe6IlF%d -f/tmp/magick-285180cu2h8-za8SH0 -f/tmp/magick-2851801krBig31sb4l
32002     285321 99.7  0.0 109288 14488 ?        R    16:37  14:38 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285320YkbQdEUUK0YA%d -f/tmp/magick-285320ERLfgO85c2PO -f/tmp/magick-285320l1YIKYAqx9G2
32002     285461 99.7  0.0 109260 14456 ?        R    16:37  14:28 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285450fEtTHsmeTL2M%d -f/tmp/magick-285450O8yL898p113C -f/tmp/magick-285450tzMYWF0gXq5s
32002     285472 99.8  0.0 109260 14456 ?        R    16:37  14:28 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285470jkhgVhNdsPE2%d -f/tmp/magick-285470ccORqjrJ7iUR -f/tmp/magick-285470WJbjbsV34U9G

 

[cPanelMichael]

I have merged these threads. To paraphrase internal case 96401:

The issue occurs on CentOS 5 systems when users within Horde take actions (probably related to attachments) that cause processes to consume 100% CPU for very long (likely infinite) periods of time. Ghostscript sees chunks of data it does not understand, but continues to try to process the file and gets itself stuck in an infinite loop which makes no system calls, probably as a result of failed preconditions.

There is currently no specific time frame or estimate on when a resolution might be implemented. The recommended workaround is to manually kill the processes.

Thank you.

 

[garconcn]

Are you guys using CSF on your cpanel?

I have seen the same problem recently. I found that before CSF report a suspicous process running under user cpanelhorde, it removed a file name like "magick-xxx" from /tmp directory. You can add the cpanelhorde user to file inogre list so that its file won't be removed.

         # echo 'user:cpanelhorde' >> /etc/csf/csf.fignore
         # csf -q

===CSF Suspicious File Alert===
File:   /tmp/magick-22968H96hov0rpgmD
Reason: Suspicious symlink (->/var/cpanel/userhomes/cpanelhorde/cache/imgGdashL)
Owner:  cpanelhorde:cpanelhorde (32002:32002)
Action: Symlink removed

===Suspicious process running under user cpanelhorde===
Time:    Wed Apr 23 10:52:41 2014 -0700
PID:     22897 (Parent PID:22715)
Account: cpanelhorde
Uptime:  18347 seconds


Executable:

/usr/local/cpanel/3rdparty/php/54/bin/php-cgi


Command Line (often faked in exploits):

/usr/local/cpanel/3rdparty/php/54/bin/php-cgi -c /usr/local/cpanel/3rdparty/php/54/etc/horde /usr/local/cpanel/base/horde/imp/view.php


Network connections by the process (if any):

tcp: 127.0.0.1:47935 -> 127.0.0.1:3306
tcp: 127.0.0.1:47937 -> 127.0.0.1:3306
tcp: 127.0.0.1:49481 -> 127.0.0.1:143


Files open by the process (if any):

/usr/local/cpanel/logs/error_log
/var/cpanel/horde/log/[email protected]
/var/cpanel/userhomes/cpanelhorde/sessions/sess_7nciu8dsuq7nsphq2ju8ag1e27
/var/cpanel/userhomes/cpanelhorde/cache/phpDK61YK


===/usr/local/cpanel/logs/error_log===
identify: `%s' (%d) "gs" -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=pbmraw" -dTextAlphaBits=4 -dGraph
icsAlphaBits=4 "-r72x72" -dUseCIEColor  "-sOutputFile=/tmp/magick-22968mlrHPXRvRQOE-1" "-f/tmp/magick-22968afZur9OAyt5D" "-f/tmp/magick-22968H96hov0rpgmD" @ error/utility
.c/SystemCommand/2036.
identify: Postscript delegate failed `/var/cpanel/userhomes/cpanelhorde/cache/imgGdashL': No such file or directory @ error/pdf.c/ReadPDFImage/682.
PHP Fatal error:  Uncaught exception 'Horde_Imap_Client_Exception' with message 'Mail server closed the connection unexpectedly.' in /usr/local/cpanel/3rdparty/php/54/lib/php/Horde/Imap/Client/Socket/Connection/Socket.php:142
Stack trace: