Excessive resource usage: cpanelconnecttrack

Legin76

Well-Known Member
Dec 11, 2007
173
2
68
Hi

Is this something I need to worry about or should I ignore it?
lfd on servername.com: Excessive resource usage: cpanelconnecttrack (7303 (Parent PID:7303))
Time: Sat May 23 06:16:36 2015 +0100
Account: cpanelconnecttrack
Resource: Process Time
Exceeded: 14453 > 7200 (seconds)
Executable: /usr/local/cpanel/3rdparty/sbin/p0f
Command Line: /usr/local/cpanel/3rdparty/sbin/p0f -i any -u cpanelconnecttrack -d -s /var/cpanel/userhomes/cpanelconnecttrack/p0f.socket
PID: 7303 (Parent PID:7303)
Killed: No
 

Legin76

Well-Known Member
Dec 11, 2007
173
2
68
Yes but I don't know if the process is harmfull or not.
I'm getting the emails every hour. It's up to 75865 > 7200 (seconds)

7303 cpanelco 20 0 13100 5144 4444 S 0.3 0.1 10:32.75 p0f

Should I set it to ignore, kill the prosess and / or do I need to investigate more.
 

Infopro

Well-Known Member
May 20, 2003
17,090
518
613
Pennsylvania
cPanel Access Level
Root Administrator
Twitter

Legin76

Well-Known Member
Dec 11, 2007
173
2
68
To be honest I'd looked into it by searching for "cpanel p0f" and only found a mention got
"Fixed case 188329: Make p0f listen on all interfaces." in the change log from 20-05-15 and
restarts the passive OS fingerprinting service from the docs. So I didn't think it was harmful but don't know if it's supposed to be constantly running or if I should lfd set to ignore or if it needs to be fixed.

Thanks
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,216
463
Hello,

You can configure LFD to ignore that process, as it's a standard process that runs with cPanel.

Thank you.
 

jmginer

Well-Known Member
Jul 26, 2006
151
4
168
Alicante
cPanel Access Level
Root Administrator
This process is using around 1 core of CPU usage!!!

This is a server with 16 cores, and 1 core usage just for p0f

bestpic.es/image/1437160011.png
 
Last edited by a moderator:

mike_

Member
Aug 22, 2011
6
2
53
Also seeing 100% of one core utilisation on one of our servers:

Code:
Tasks: 248 total,   2 running, 245 sleeping,   0 stopped,   1 zombie

Cpu(s):  6.4%us, 26.1%sy,  0.0%ni, 65.2%id,  1.4%wa,  0.0%hi,  0.0%si,  0.9%st

Mem:   8040956k total,  7585432k used,   455524k free,   843692k buffers

Swap:  4194300k total,  2578332k used,  1615968k free,  4070868k cached



    PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                                                                                                                           

357299 cpanelco  20   0 13660 5644 4444 R 85.8  0.1   4830:21 p0f
I've disabled p0f until this is resolved
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,216
463
Hello :)

Internal case CPANEL-699 aims to improve the performance for passive OS fingerprinting:

Fixed case CPANEL-699: Avoid p0f watching port 80 and 443 for performance reasons.

It's included with cPanel version 11.52, which is currently only available in the "Edge" build tier.

Thank you.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,216
463
Can you tell us what to do when it is taking up as much cpu as mysqld?
You can disable it via "WHM >> Service Configuration >> Service Manager" in the meantime. It's named "Passive OS Fingerprinting Daemon".

Thank you.
 
  • Like
Reactions: StevenM.