Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

[Case 96401] Horde Creating High Server Loads - cpanelhorde user and gs process

Discussion in 'General Discussion' started by Eltawoos, Apr 19, 2014.

  1. Eltawoos

    Eltawoos Member

    Joined:
    Apr 19, 2014
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hello,
    There is an issue we faced in our shared hosting server.
    Our server is loaded for more times and we found that user "cpanelho" has utilize the resources by command "gs" .. Could you please advice what is it process and how is it working and what can do on the server?

    ------------------
    cpanelho 20 0 106m 17m 5420 R 99.5 0.1 2092:01 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=800000000 -dAlig
    -----------------


    Waiting for your reply.
     
    #1 Eltawoos, Apr 19, 2014
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,379
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Re: Cpanelho gs process?!

    Hello :)

    Could you verify which OS is installed on your system?

    Code:
    cat /etc/redhat-release
    Please also post the output from:

    Code:
    rpm -qa|grep ghostscript
    This will help us to determine if your issue is related to an internal case that's open (#96401).

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 cPanelMichael, Apr 21, 2014
  3. Eltawoos

    Eltawoos Member

    Joined:
    Apr 19, 2014
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Re: Cpanelho gs process?!

    Yes, I think that's related ghostscript
    Sys v: Cloudlinux 5.6
    How can i check for internal case that's open #96401
     
    #3 Eltawoos, Apr 21, 2014
  4. markhubert

    markhubert Member

    Joined:
    Jan 7, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    151
    Horde Creating High Server Loads - cpanelhorde user and gs process

    Trying to figure out the cause and how to stop this high usage of CPU. Any suggestions appreciated.
    Code:
    
Pid	Owner	Priority	CPU %	Memory %	Command
4093	32007	0	  93.4	0.0	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-4092fTXcvajzkDDp%d -f/tmp/magick-40925ZZPz1B6LbJY -f/tmp/magick-40926pXNjYJcYaPx

15491	32007	0	  93.4	0.0	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-15490FowC0eEiVZVI%d -f/tmp/magick-15490cQ7begKoJyOS -f/tmp/magick-15490x2uzBzY6UeH2

32552	32007	0	  88.7	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-32551jAPcpmfPmUIn%d -f/tmp/magick-32551VY2RuHimqju3 -f/tmp/magick-32551WWevl63R80fJ

740	32007	0	  88.3	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-739G9NTn6vD78TO%d -f/tmp/magick-739S46qE2sdCa9i -f/tmp/magick-739kucVUSxdzjoN

32641	32007	0	  88.3	0.3	gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-32640elUGSXfrmeXH%d -f/tmp/magick-32640eLIK6nLd3BAX -f/tmp/magick-32640DjBI2mv976dd
     
    #4 markhubert, Apr 21, 2014
  5. MikeDVB

    MikeDVB Well-Known Member
    PartnerNOC

    Joined:
    Jun 4, 2008
    Messages:
    218
    Likes Received:
    3
    Trophy Points:
    68
    Location:
    Indiana, USA
    I see nothing that indicates Horde - but it does look like ImageMagick processes processing images. Looks like you have a site that relies heavily upon it and that's where your CPU is going.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #5 MikeDVB, Apr 21, 2014
  6. markhubert

    markhubert Member

    Joined:
    Jan 7, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    151
    The user 32007 is cpanelhorde
     
    #6 markhubert, Apr 21, 2014
  7. julissax

    julissax Registered

    Joined:
    Apr 21, 2014
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Re: Cpanelho gs process?!

    Hi,

    I have the same problem, thanks in advance.

    Logs:

    nice top
    Code:
        PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                           
 285321 cpanelho  25   0  106m  14m 4504 R 99.8  0.0  11:53.67 gs                                                                                                                
 285186 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:56.97 gs                                                                                                                
 285461 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:43.59 gs                                                                                                                
 285472 cpanelho  25   0  106m  14m 4504 R 98.0  0.0  11:43.22 gs

    cat /etc/redhat-release
    Code:
    CloudLinux Server release 5.10 (Georgy Beregovoy)
    rpm -qa|grep ghostscript
    Code:
    ghostscript-8.70-15.el5_9.3
ghostscript-fonts-5.50-13.1.1

    ps aux | grep gs
    Code:
    32002     285186 99.7  0.0 109288 14488 ?        R    16:37  14:41 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285180uiVhnnXe6IlF%d -f/tmp/magick-285180cu2h8-za8SH0 -f/tmp/magick-2851801krBig31sb4l
32002     285321 99.7  0.0 109288 14488 ?        R    16:37  14:38 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285320YkbQdEUUK0YA%d -f/tmp/magick-285320ERLfgO85c2PO -f/tmp/magick-285320l1YIKYAqx9G2
32002     285461 99.7  0.0 109260 14456 ?        R    16:37  14:28 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285450fEtTHsmeTL2M%d -f/tmp/magick-285450O8yL898p113C -f/tmp/magick-285450tzMYWF0gXq5s
32002     285472 99.8  0.0 109260 14456 ?        R    16:37  14:28 gs -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 -sDEVICE=pbmraw -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72x72 -sOutputFile=/tmp/magick-285470jkhgVhNdsPE2%d -f/tmp/magick-285470ccORqjrJ7iUR -f/tmp/magick-285470WJbjbsV34U9G
     
    #7 julissax, Apr 21, 2014
  8. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,379
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    I have merged these threads. To paraphrase internal case 96401:

    The issue occurs on CentOS 5 systems when users within Horde take actions (probably related to attachments) that cause processes to consume 100% CPU for very long (likely infinite) periods of time. Ghostscript sees chunks of data it does not understand, but continues to try to process the file and gets itself stuck in an infinite loop which makes no system calls, probably as a result of failed preconditions.

    There is currently no specific time frame or estimate on when a resolution might be implemented. The recommended workaround is to manually kill the processes.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #8 cPanelMichael, Apr 22, 2014
  9. garconcn

    garconcn Well-Known Member

    Joined:
    Oct 29, 2009
    Messages:
    132
    Likes Received:
    6
    Trophy Points:
    68
    Are you guys using CSF on your cpanel?

    I have seen the same problem recently. I found that before CSF report a suspicous process running under user cpanelhorde, it removed a file name like "magick-xxx" from /tmp directory. You can add the cpanelhorde user to file inogre list so that its file won't be removed.
    Code:
             # echo 'user:cpanelhorde' >> /etc/csf/csf.fignore
         # csf -q

===CSF Suspicious File Alert===
File:   /tmp/magick-22968H96hov0rpgmD
Reason: Suspicious symlink (->/var/cpanel/userhomes/cpanelhorde/cache/imgGdashL)
Owner:  cpanelhorde:cpanelhorde (32002:32002)
Action: Symlink removed

===Suspicious process running under user cpanelhorde===
Time:    Wed Apr 23 10:52:41 2014 -0700
PID:     22897 (Parent PID:22715)
Account: cpanelhorde
Uptime:  18347 seconds


Executable:

/usr/local/cpanel/3rdparty/php/54/bin/php-cgi


Command Line (often faked in exploits):

/usr/local/cpanel/3rdparty/php/54/bin/php-cgi -c /usr/local/cpanel/3rdparty/php/54/etc/horde /usr/local/cpanel/base/horde/imp/view.php


Network connections by the process (if any):

tcp: 127.0.0.1:47935 -> 127.0.0.1:3306
tcp: 127.0.0.1:47937 -> 127.0.0.1:3306
tcp: 127.0.0.1:49481 -> 127.0.0.1:143


Files open by the process (if any):

/usr/local/cpanel/logs/error_log
/var/cpanel/horde/log/horde_user@domain.log
/var/cpanel/userhomes/cpanelhorde/sessions/sess_7nciu8dsuq7nsphq2ju8ag1e27
/var/cpanel/userhomes/cpanelhorde/cache/phpDK61YK


===/usr/local/cpanel/logs/error_log===
identify: `%s' (%d) "gs" -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=pbmraw" -dTextAlphaBits=4 -dGraph
icsAlphaBits=4 "-r72x72" -dUseCIEColor  "-sOutputFile=/tmp/magick-22968mlrHPXRvRQOE-1" "-f/tmp/magick-22968afZur9OAyt5D" "-f/tmp/magick-22968H96hov0rpgmD" @ error/utility
.c/SystemCommand/2036.
identify: Postscript delegate failed `/var/cpanel/userhomes/cpanelhorde/cache/imgGdashL': No such file or directory @ error/pdf.c/ReadPDFImage/682.
PHP Fatal error:  Uncaught exception 'Horde_Imap_Client_Exception' with message 'Mail server closed the connection unexpectedly.' in /usr/local/cpanel/3rdparty/php/54/lib/php/Horde/Imap/Client/Socket/Connection/Socket.php:142
Stack trace:
     
    #9 garconcn, Apr 23, 2014
    Last edited: Apr 23, 2014
(You must log in or sign up to post here.)
Loading...
Similar Threads - [Case 96401] Horde
  1. swbrains

    SOLVED [Case CPANEL-20422] New account redirects to defaultwebpage in 70

    swbrains, May 13, 2018, in forum: General Discussion
    Replies:
    15
    Views:
    290
    swbrains
    May 16, 2018
  2. martin MHC

    SOLVED SpamAssassin is now Integer only instead of Decimal in WHM 70 [case CPANEL-20394]

    martin MHC, May 11, 2018, in forum: E-mail Discussion
    Replies:
    22
    Views:
    375
    martin MHC
    May 16, 2018
  3. cPanelMichael

    SOLVED [Case CPANEL-20319] Conflicting A records are added for proxy subdomains upon update to version 70

    cPanelMichael, May 9, 2018, in forum: General Discussion
    Replies:
    3
    Views:
    549
    cPanelMichael
    May 10, 2018
  4. jamiepenner

    SOLVED AutoSSL Proxy Subdomain Validation [case CPANEL-18074]

    jamiepenner, Feb 21, 2018, in forum: General Discussion
    Replies:
    3
    Views:
    499
    cPanelMichael
    Feb 21, 2018
  5. brianc

    SOLVED [Case CPANEL-18456] Mailman Archives fail to restore and/or be removed

    brianc, Feb 3, 2018, in forum: General Discussion
    Replies:
    4
    Views:
    361
    cPanelMichael
    Feb 14, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice