Error CPU usage is currently at 95%. Please, sign in to fix this problem.

[Leonidas Savvides]

I got this email from my GoDaddy Registrar for Europe VPS WHM/cPanel CentOS 7.9

How check the cPanel account domainname.yyy that having this traffic? Or check traffic per cPanel account...?
As I have logged in a mentioned also WHM needs apply an update...
You have any idea where must be the problem?

​ Your server usage is very high.​

​ Your server usage is currently very high. Your CPU usage is currently at 95%. Please, sign in to fix this problem. Here are the details: Server name: ************** IP address: ***.***.***.*** Start time: 06 March 2021 14:12:25 GMT If this usage is due to high traffic rather than an error, it's probably time to consider upgrading to a plan with more resources.​

 

[ZenHostingTravis]

Hi @Leonidas Savvides,

If it's a managed VPS, GoDaddy should tell you what is contributing to the high load.

When you log into WHM, you should be able to see what the load averages are and if you drill down, what processes are running.

If you have SSH access, try using the "top" command.

 

[Leonidas Savvides]

I fixed somehow CPU usage from 99% to ~70%, I think an under-construction site script's faults... I sandboxed it
1
but Email Relays overpassed again
SMTP relays
5001 / 5000
2
See attachments,... if do upgrade WHM tomorrow morning may fix this???
CENTOS 7.9 kvm [ip-*************] v92.0.11 >>> to >>>
Version “94.0.2” is available. Update Now
3
How long should take???
4
Also, now PHP is 7.1/7.2 --- after upgrade WHM, then PHP 7.3/7.4 should become available, if Not, what have to do to have option eg 7.4 PHP...?

 

[Leonidas Savvides]

I plan to upgrade WHM from 92.0.11 to 94.0.2, now at 04:00 in the morning I have:

Usage
View All Usage
59%
1 CPU core
59.66% / 100%
47%
RAM
0.94GB / 2GB
47%
Disk space
18.8GB / 40GB
100%
SMTP relays
5001 / 5000

is OK to upgrade like this?

why
SMTP relays
5001 / 5000
means may have an attacker sending email
?

In terminal CLI I get for top command the: see attached... what to do? Where you think is the error?

 

[Leonidas Savvides]

Can you help, is my VPS 1-core CPU needs a hardware update[due to legitimate traffic], or I am under cyber-attack??

now getting
see attachments 99% load

 

[ZenHostingTravis]

Hi @Leonidas Savvides,

I'd look at increasing the number of cores from 1 to at least 2.

Re the SMTP relay, it looks like a lot of email is being relayed.

Contact our service provider re the details of the emails being sent.

 

[Leonidas Savvides]

Unblock ports required for my Gen 4 server | Gen 4 VPS & Dedicated Servers - GoDaddy Help GB

Maybe victim of cyberattack, DoS...?

 

[Leonidas Savvides]

1
https://uk.godaddy.com/help/unblock-ports-required-for-my-gen-4-server-27924

trying this ^^^ getting: // well? Need activate firewall?

FirewallD is not running

2
How find web site/cPanel account responsible for the email relays...?

 

[ZenHostingTravis]

Hi @Leonidas Savvides,

I'd recommend contacting GoDaddy for further help.

Generally, it's not advisable to leave the firewall turned off for an extended period of time. It should be turned on, along with LFD.

 

[Leonidas Savvides]

I removed some CPU load on the Server[now become 75-80%] by change settings of some installed PHP Apps like Prestashop from auto back/update,... to manual
You have any idea why this continued, or why existing these:

SMTP relays
5001 / 5000
?
means may have an attacker sending email
?

 

[Leonidas Savvides]

can you make any conclusion...
see attachment
0 email relays 1%
>>>
In one day went 5001/5000 100%
and continue 100% per day from about 03-03-2021 till today...well...?

 

[cPRex]

You may want to try working through the following guide to confirm that your server is not sending spam:

How to find the source of spam emails

Introduction In this article, we will be exploring means to determine how spam emails were sent from your server. This is meant to guide you in the right direction in which a further, more in-dep...

support.cpanel.net

 

[Leonidas Savvides]

I think the problem is ONLY with one Site domain having many subdomains and installed some PHP apps in each subdomain...

I changed DNS to deactivate the public reach of this site/domain, with the hope of temporary fix the problem, since this site is owned by myself

When DNS propagated and deactivate the site, I will check CPU usage again

I will also check the email source of relays consumed

You think if I upgrade to the newer WHM/cPanel version & PHP 7.4 (now 7.2), may fix the problem... ??? see the shot attached

 

[Leonidas Savvides]

Is any way limit smtp relays per domain eg 30/domain/day...?
The email setup are all forwards mainly to GMAIL of clients accounts...

 

[Leonidas Savvides]

did this >>
2021-03-09_08-52-03.png
get
2021-03-09_10-55-45.png
0 email relays

but CPU continued overloading so, did
2021-03-09_13-02-29.png
get
Bandwidth Limit Exceeded
The server is temporarily unable to service your request due to the site owner reaching his/her bandwidth limit. Please try again later.
in the problem domain
and get CPU only 7% --- proved domain problem the one set Bandwidth Limit,
2021-03-09_13-10-17.png

what you recommend set for Bandwidth Limit...? Temporary can Not access domain msg: "Bandwidth Limit Exceeded ..."

 

[Leonidas Savvides]

as of just now checking the VPS server resources
again problem CPU and Email relay almost exhausted

2021-03-09_15-13-38.png

even stop via bandwidth limit of the problematic domain and even set email limits for all domains... now what?

 

[cPRex]

There isn't a correct value for the bandwidth limit, as that is just how much network resource the site needs. 20M is incredibly low, and even just bot activity would likely hit that limit within 24 hours.

Did you notice any difference in behavior when you changed the DNS for the domain? If you still see the bandwidth and CPU usage high, that would mean something unrelated to the site is running on the account and using those resources.

I believe with these issues it might be best to get a ticket submitted to our team so we can take a look at the system directly.

 

[Leonidas Savvides]

CPU is OK but
I do Not understand relays SMTP again
at WHM's Tweak Settings interface (WHM >> Home >> Server Configuration >> Tweak Settings)
I have set/entered email SMTP limits, Server Configuration settings but AGAIN THE MAX HAPPEN...
SMTP relays
5002 / 5000
CAN you guess why this happens????

 

[cPRex]

I'm not sure why that would be happening, although I would guess it is related to the CPU usage for the domain. If you have root access to the system you could submit a ticket and we can try to get more details.

 

[Leonidas Savvides]

you have any idea how to find the cPanel / Domain account that made all these SMTP Relays,...?
from cPanel or from CLI/bash access...?
Before 4 days relays were 30-50/day only the max