Excessive resource usage Executable: /usr/lib/systemd/systemd Command Line: (sd-pam)

Operating System & Version
AlmaLinux 8.5.0
cPanel & WHM Version
100.0.9

Spirogg

Well-Known Member
Feb 21, 2018
700
160
43
chicago
cPanel Access Level
Root Administrator
Hello,
I am aware that CSF reports these via email, but I have never seen this with one of my websites .

usually its /usr/bin/curl
or /opt/cpanel/ea-php7.4/root/usr/sbin/php-fpm
or /opt/cpanel/ea-php8/root/usr/sbin/php-fpm

but never systemd or command line (sd-pam)

Any reason you can think of for this?
possible it's Cron's running on my website script?
but why this is happening on AlmaLinux OS and not Centos7 server same website -script I had for years.

I am running AlmaLinux 8.5.0 and cPanel 100.0.9
using Autom8n plugin for Nginx for this account.
php7.4
MySQL 8

Im getting 2 emails every hour

here is 2 of the emails same time stamp but a little different

( NOTE: the Parent PID of the first one is itself?)
1st example

Code:
Time: Fri Feb 4 17:52:27 2022 -0600
Account: mywebsite11
Resource: Process Time
Exceeded: 48745 > 1800 (seconds)
Executable: /usr/lib/systemd/systemd
Command Line: /usr/lib/systemd/systemd -- user
PID: 3294 (Parent PID:3294)
Killed: No
2nd one the Parent PID is 3294 but PID is 3296
2nd example
Code:
Time: Fri Feb 4 17:52:27 2022 -0600
Account: mywebsite11
Resource: Process Time
Exceeded: 48745 > 1800 (seconds)
Executable: /usr/lib/systemd/systemd
Command Line: (sd-pam)
PID: 3296 (Parent PID:3294)
Killed: No
I know I can silence them in pignore but I would rather find out why it's running systemd and sd-pam
before I do so.


wonder if its because New Operating System? AlmaLinux 8.5.0

Because it was not doing this with CentOS7


Thanks in advance if anyone has an answer or where to find an answer

Kind Regards,
Spiro
 
Last edited by a moderator:

Spirogg

Well-Known Member
Feb 21, 2018
700
160
43
chicago
cPanel Access Level
Root Administrator
Pretty much I’m wondering if this is normal or is this an issue with systemd ? Should it not kill the process or does it run since my website is live. Or because I have 5 min interval to run cron jobs ?
Just not sure if this is a normal process
 
  • Like
Reactions: Naila

quietFinn

Well-Known Member
Feb 4, 2006
1,695
350
438
Finland
cPanel Access Level
Root Administrator
In a VPS running AlmaLinux I see that process running as the user I have SSH connection to the server.

If I open SFTP connection as a cPanel user I see that sd-pam process running as that cPanel user.

Was googling a bit and as far as I understand that is normal.
 
  • Like
Reactions: Spirogg

Spirogg

Well-Known Member
Feb 21, 2018
700
160
43
chicago
cPanel Access Level
Root Administrator
In a VPS running AlmaLinux I see that process running as the user I have SSH connection to the server.

If I open SFTP connection as a cPanel user I see that sd-pam process running as that cPanel user.

Was googling a bit and as far as I understand that is normal.
Ok. Thanks for your reply.
I have not logged in as that user just as root. Also did not use SFTP for that user ?
But still getting this every hour and it just increases the time. After you close that session. Does it stop the process SSH or SFTP or still running can you tell somehow ?
is it normal if I have not logged in as that user but via as root ? Or if I login to WHM and go to cPanel for that user even as root it will run that process ?
Just wondering. Hopefully in my case it’s just normal.
Thanks again for your reply. It is much appreciated:)
Kind Regards
SPIRO
 

quietFinn

Well-Known Member
Feb 4, 2006
1,695
350
438
Finland
cPanel Access Level
Root Administrator
I never open SSH connection to any server as root so I don't know if it creates such a process.

If I go to cPanel -> Advanced -> Terminal I see that sd-pam process running as that cPanel user.

If you run:
ps auxf | grep "sd-pam"
you see those processes.
 

Spirogg

Well-Known Member
Feb 21, 2018
700
160
43
chicago
cPanel Access Level
Root Administrator
I never open SSH connection to any server as root so I don't know if it creates such a process.

If I go to cPanel -> Advanced -> Terminal I see that sd-pam process running as that cPanel user.

If you run:
ps auxf | grep "sd-pam"
you see those processes.


I see it, but I am logged in as root via WHM and used Terminal

Code:
[[email protected] ~]# ps auxf | grep "sd-pam"
root      298727  0.0  0.0 221932  1112 pts/0    S+   19:34   0:00          \_ grep --color=auto sd-pam
lats+  298320  0.0  0.0 285832  5164 ?        S    19:30   0:00  \_ (sd-pam)
also if I grep systems I see the user lats+

Code:
[[email protected] ~]# ps auxf | grep "systemd"
root           1  0.1  0.0 241248 12576 ?        Ss   Feb04   6:45 /usr/lib/systemd/systemd --switched-root --system --deserialize 16
root        1090  0.0  0.2 397128 258612 ?       Ss   Feb04   1:15 /usr/lib/systemd/systemd-journald
root        1142  0.0  0.0 106128  9220 ?        Ss   Feb04   0:01 /usr/lib/systemd/systemd-udevd
dbus        1468  0.0  0.0  76984  5832 ?        Ss   Feb04   1:35 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root        1830  0.0  0.0  79744  7560 ?        Ss   Feb04   0:41 /usr/lib/systemd/systemd-logind
root      299230  0.0  0.0 221932  1184 pts/0    S+   19:42   0:00  |       \_ grep --color=auto systemd
lats+  298318  0.0  0.0  89472  9328 ?        Ss   19:30   0:00 /usr/lib/systemd/systemd --user

I also have 2 other websites but they are not showing in grep under sd-pam or grep systemd

so wondering why its still running or seems as if its still logged in as sd-pam and systemd --user even though I am not logged in via SSH or SFTP for this user ?

thanks again for your replies :)

Spiro
 

Spirogg

Well-Known Member
Feb 21, 2018
700
160
43
chicago
cPanel Access Level
Root Administrator
Well I killed those processes and now there not showing. So I will wait a couple hours and check again if they start by themselves. If so I need to check that script to make sure it’s not opening up ssh or SFTP somehow. Thanks again for your help. At least I’m on the right track to finding out :)

thanks so much
@quietFinn

SPIRO
 

quietFinn

Well-Known Member
Feb 4, 2006
1,695
350
438
Finland
cPanel Access Level
Root Administrator
Well I killed those processes and now there not showing. So I will wait a couple hours and check again if they start by themselves. If so I need to check that script to make sure it’s not opening up ssh or SFTP somehow. Thanks again for your help. At least I’m on the right track to finding out :)
Probably it was just a "zombie" process.
 
  • Like
Reactions: Spirogg

JIKOmetrix

Well-Known Member
Apr 3, 2007
183
34
178
I know this is an old post.

I had the same issue. I was related jailed-shell. Once the user was moved to Normal shell or disabled shell then the "sd-pam" noticed stopped and ps auxf | grep "sd-pam" did not show any user but root.