The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Excessive resource usage: cpanelconnecttrack

Discussion in 'General Discussion' started by Legin76, May 23, 2015.

  1. Legin76

    Legin76 Well-Known Member

    Joined:
    Dec 11, 2007
    Messages:
    151
    Likes Received:
    1
    Trophy Points:
    18
    Hi

    Is this something I need to worry about or should I ignore it?
    lfd on servername.com: Excessive resource usage: cpanelconnecttrack (7303 (Parent PID:7303))
    Time: Sat May 23 06:16:36 2015 +0100
    Account: cpanelconnecttrack
    Resource: Process Time
    Exceeded: 14453 > 7200 (seconds)
    Executable: /usr/local/cpanel/3rdparty/sbin/p0f
    Command Line: /usr/local/cpanel/3rdparty/sbin/p0f -i any -u cpanelconnecttrack -d -s /var/cpanel/userhomes/cpanelconnecttrack/p0f.socket
    PID: 7303 (Parent PID:7303)
    Killed: No
     
  2. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    14,474
    Likes Received:
    202
    Trophy Points:
    63
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    StevenM. likes this.
  3. Legin76

    Legin76 Well-Known Member

    Joined:
    Dec 11, 2007
    Messages:
    151
    Likes Received:
    1
    Trophy Points:
    18
    Yes but I don't know if the process is harmfull or not.
    I'm getting the emails every hour. It's up to 75865 > 7200 (seconds)

    7303 cpanelco 20 0 13100 5144 4444 S 0.3 0.1 10:32.75 p0f

    Should I set it to ignore, kill the prosess and / or do I need to investigate more.
     
  4. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    14,474
    Likes Received:
    202
    Trophy Points:
    63
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    You should look into it instead of waiting for a forum user to reply to you:
    http://search.cpan.org/~saper/Net-P0f-0.02/lib/Net/P0f.pm

    You could:
    Code:
    exe:/usr/local/cpanel/3rdparty/sbin/p0f
    If you're unsure you should consider hiring a Professional to assist you with this.
     
  5. Legin76

    Legin76 Well-Known Member

    Joined:
    Dec 11, 2007
    Messages:
    151
    Likes Received:
    1
    Trophy Points:
    18
    To be honest I'd looked into it by searching for "cpanel p0f" and only found a mention got
    "Fixed case 188329: Make p0f listen on all interfaces." in the change log from 20-05-15 and
    restarts the passive OS fingerprinting service from the docs. So I didn't think it was harmful but don't know if it's supposed to be constantly running or if I should lfd set to ignore or if it needs to be fixed.

    Thanks
     
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
  7. Legin76

    Legin76 Well-Known Member

    Joined:
    Dec 11, 2007
    Messages:
    151
    Likes Received:
    1
    Trophy Points:
    18
    Excellent... Thank you for your help
     
  8. jmginer

    jmginer Well-Known Member

    Joined:
    Jul 26, 2006
    Messages:
    91
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Benifato, Spain
    This process is using around 1 core of CPU usage!!!

    This is a server with 16 cores, and 1 core usage just for p0f

    bestpic.es/image/1437160011.png
     
    #8 jmginer, Jul 17, 2015
    Last edited by a moderator: Jul 17, 2015
  9. mike_

    mike_ Member

    Joined:
    Aug 22, 2011
    Messages:
    6
    Likes Received:
    1
    Trophy Points:
    1
    Also seeing 100% of one core utilisation on one of our servers:

    Code:
    Tasks: 248 total,   2 running, 245 sleeping,   0 stopped,   1 zombie
    
    Cpu(s):  6.4%us, 26.1%sy,  0.0%ni, 65.2%id,  1.4%wa,  0.0%hi,  0.0%si,  0.9%st
    
    Mem:   8040956k total,  7585432k used,   455524k free,   843692k buffers
    
    Swap:  4194300k total,  2578332k used,  1615968k free,  4070868k cached
    
    
    
        PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                                                                                                                           
    
    357299 cpanelco  20   0 13660 5644 4444 R 85.8  0.1   4830:21 p0f 
    I've disabled p0f until this is resolved
     
  10. k2tec

    k2tec Well-Known Member

    Joined:
    Aug 26, 2011
    Messages:
    81
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Netherlands
    cPanel Access Level:
    Root Administrator
    I have one server with whm 11.50.0 (build29) enabled p0f-cpanelsync. Normale usage of 0.3% cpu
    on the other server with whm 11.50.0 (build27) enabled p0f-cpanelsync Usage of 97-100% I disabled it but no difference.
     
  11. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    14,474
    Likes Received:
    202
    Trophy Points:
    63
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Please feel free to open a ticket with cPanel Technical Support about this.
     
  12. k2tec

    k2tec Well-Known Member

    Joined:
    Aug 26, 2011
    Messages:
    81
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Netherlands
    cPanel Access Level:
    Root Administrator
    Thanks Infopro,
    I looked this morning to my log and system usage but at this time it is normal.
    But I will keep watching this server because it was not the first time that p0f used a lot of recource.
     
    Infopro likes this.
  13. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    Internal case CPANEL-699 aims to improve the performance for passive OS fingerprinting:

    Fixed case CPANEL-699: Avoid p0f watching port 80 and 443 for performance reasons.

    It's included with cPanel version 11.52, which is currently only available in the "Edge" build tier.

    Thank you.
     
  14. sonicthoughts

    sonicthoughts Well-Known Member

    Joined:
    Apr 4, 2011
    Messages:
    61
    Likes Received:
    3
    Trophy Points:
    8
    Can you tell us what to do when it is taking up as much cpu as mysqld?
     
  15. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    You can disable it via "WHM >> Service Configuration >> Service Manager" in the meantime. It's named "Passive OS Fingerprinting Daemon".

    Thank you.
     
    StevenM. likes this.
Loading...

Share This Page