The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

[Case 96401] Horde Creating High Server Loads - cpanelhorde user and gs process

Discussion in 'General Discussion' started by Eltawoos, Apr 19, 2014.

  1. Eltawoos

    Eltawoos Member

    Joined:
    Apr 19, 2014
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hello,
    There is an issue we faced in our shared hosting server.
    Our server is loaded for more times and we found that user "cpanelho" has utilize the resources by command "gs" .. Could you please advice what is it process and how is it working and what can do on the server?

    ------------------
    cpanelho 20 0 106m 17m 5420 R 99.5 0.1 2092:01 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=800000000 -dAlig
    -----------------


    Waiting for your reply.
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,723
    Likes Received:
    660
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Re: Cpanelho gs process?!

    Hello :)

    Could you verify which OS is installed on your system?

    Code:
    cat /etc/redhat-release
    Please also post the output from:

    Code:
    rpm -qa|grep ghostscript
    This will help us to determine if your issue is related to an internal case that's open (#96401).

    Thank you.
     
  3. Eltawoos

    Eltawoos Member

    Joined:
    Apr 19, 2014
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Re: Cpanelho gs process?!

    Yes, I think that's related ghostscript
    Sys v: Cloudlinux 5.6
    How can i check for internal case that's open #96401
     
  4. markhubert

    markhubert Member

    Joined:
    Jan 7, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    1
    Horde Creating High Server Loads - cpanelhorde user and gs process

    Trying to figure out the cause and how to stop this high usage of CPU. Any suggestions appreciated.
    Code:
    
    Pid	Owner	Priority	CPU %	Memory %	Command
    4093	32007	0	  93.4	0.0	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-4092fTXcvajzkDDp%d -f/tmp/magick-40925ZZPz1B6LbJY -f/tmp/magick-40926pXNjYJcYaPx
    
    15491	32007	0	  93.4	0.0	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-15490FowC0eEiVZVI%d -f/tmp/magick-15490cQ7begKoJyOS -f/tmp/magick-15490x2uzBzY6UeH2
    
    32552	32007	0	  88.7	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-32551jAPcpmfPmUIn%d -f/tmp/magick-32551VY2RuHimqju3 -f/tmp/magick-32551WWevl63R80fJ
    
    740	32007	0	  88.3	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-739G9NTn6vD78TO%d -f/tmp/magick-739S46qE2sdCa9i -f/tmp/magick-739kucVUSxdzjoN
    
    32641	32007	0	  88.3	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-32640elUGSXfrmeXH%d -f/tmp/magick-32640eLIK6nLd3BAX -f/tmp/magick-32640DjBI2mv976dd
     
  5. MikeDVB

    MikeDVB Well-Known Member
    PartnerNOC

    Joined:
    Jun 4, 2008
    Messages:
    212
    Likes Received:
    3
    Trophy Points:
    18
    Location:
    Indiana, USA
    I see nothing that indicates Horde - but it does look like ImageMagick processes processing images. Looks like you have a site that relies heavily upon it and that's where your CPU is going.
     
  6. markhubert

    markhubert Member

    Joined:
    Jan 7, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    1
    The user 32007 is cpanelhorde
     
  7. julissax

    julissax Registered

    Joined:
    Apr 21, 2014
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Re: Cpanelho gs process?!

    Hi,

    I have the same problem, thanks in advance.

    Logs:

    nice top
    Code:
        PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                           
     285321 cpanelho  25   0  106m  14m 4504 R 99.8  0.0  11:53.67 gs                                                                                                                
     285186 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:56.97 gs                                                                                                                
     285461 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:43.59 gs                                                                                                                
     285472 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:43.22 gs 
    

    cat /etc/redhat-release
    Code:
    CloudLinux Server release 5.10 (Georgy Beregovoy)
    rpm -qa|grep ghostscript
    Code:
    ghostscript-8.70-15.el5_9.3
    ghostscript-fonts-5.50-13.1.1
    

    ps aux | grep gs
    Code:
    32002     285186 99.7  0.0 109288 14488 ?        R    16:37  14:41 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285180uiVhnnXe6IlF%d -f/tmp/magick-285180cu2h8-za8SH0 -f/tmp/magick-2851801krBig31sb4l
    32002     285321 99.7  0.0 109288 14488 ?        R    16:37  14:38 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285320YkbQdEUUK0YA%d -f/tmp/magick-285320ERLfgO85c2PO -f/tmp/magick-285320l1YIKYAqx9G2
    32002     285461 99.7  0.0 109260 14456 ?        R    16:37  14:28 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285450fEtTHsmeTL2M%d -f/tmp/magick-285450O8yL898p113C -f/tmp/magick-285450tzMYWF0gXq5s
    32002     285472 99.8  0.0 109260 14456 ?        R    16:37  14:28 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285470jkhgVhNdsPE2%d -f/tmp/magick-285470ccORqjrJ7iUR -f/tmp/magick-285470WJbjbsV34U9G
    
     
  8. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,723
    Likes Received:
    660
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    I have merged these threads. To paraphrase internal case 96401:

    The issue occurs on CentOS 5 systems when users within Horde take actions (probably related to attachments) that cause processes to consume 100% CPU for very long (likely infinite) periods of time. Ghostscript sees chunks of data it does not understand, but continues to try to process the file and gets itself stuck in an infinite loop which makes no system calls, probably as a result of failed preconditions.

    There is currently no specific time frame or estimate on when a resolution might be implemented. The recommended workaround is to manually kill the processes.

    Thank you.
     
  9. garconcn

    garconcn Well-Known Member

    Joined:
    Oct 29, 2009
    Messages:
    98
    Likes Received:
    1
    Trophy Points:
    8
    Are you guys using CSF on your cpanel?

    I have seen the same problem recently. I found that before CSF report a suspicous process running under user cpanelhorde, it removed a file name like "magick-xxx" from /tmp directory. You can add the cpanelhorde user to file inogre list so that its file won't be removed.
    Code:
             # echo 'user:cpanelhorde' >> /etc/csf/csf.fignore
             # csf -q
    
    ===CSF Suspicious File Alert===
    File:   /tmp/magick-22968H96hov0rpgmD
    Reason: Suspicious symlink (->/var/cpanel/userhomes/cpanelhorde/cache/imgGdashL)
    Owner:  cpanelhorde:cpanelhorde (32002:32002)
    Action: Symlink removed
    
    ===Suspicious process running under user cpanelhorde===
    Time:    Wed Apr 23 10:52:41 2014 -0700
    PID:     22897 (Parent PID:22715)
    Account: cpanelhorde
    Uptime:  18347 seconds
    
    
    Executable:
    
    /usr/local/cpanel/3rdparty/php/54/bin/php-cgi
    
    
    Command Line (often faked in exploits):
    
    /usr/local/cpanel/3rdparty/php/54/bin/php-cgi -c /usr/local/cpanel/3rdparty/php/54/etc/horde /usr/local/cpanel/base/horde/imp/view.php
    
    
    Network connections by the process (if any):
    
    tcp: 127.0.0.1:47935 -> 127.0.0.1:3306
    tcp: 127.0.0.1:47937 -> 127.0.0.1:3306
    tcp: 127.0.0.1:49481 -> 127.0.0.1:143
    
    
    Files open by the process (if any):
    
    /usr/local/cpanel/logs/error_log
    /var/cpanel/horde/log/horde_user@domain.log
    /var/cpanel/userhomes/cpanelhorde/sessions/sess_7nciu8dsuq7nsphq2ju8ag1e27
    /var/cpanel/userhomes/cpanelhorde/cache/phpDK61YK
    
    
    ===/usr/local/cpanel/logs/error_log===
    identify: `%s' (%d) "gs" -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=pbmraw" -dTextAlphaBits=4 -dGraph
    icsAlphaBits=4 "-r72x72" -dUseCIEColor  "-sOutputFile=/tmp/magick-22968mlrHPXRvRQOE-1" "-f/tmp/magick-22968afZur9OAyt5D" "-f/tmp/magick-22968H96hov0rpgmD" @ error/utility
    .c/SystemCommand/2036.
    identify: Postscript delegate failed `/var/cpanel/userhomes/cpanelhorde/cache/imgGdashL': No such file or directory @ error/pdf.c/ReadPDFImage/682.
    PHP Fatal error:  Uncaught exception 'Horde_Imap_Client_Exception' with message 'Mail server closed the connection unexpectedly.' in /usr/local/cpanel/3rdparty/php/54/lib/php/Horde/Imap/Client/Socket/Connection/Socket.php:142
    Stack trace:
     
    #9 garconcn, Apr 23, 2014
    Last edited: Apr 23, 2014
Loading...

Share This Page