lfd excessive processes running under user

ContinuIT

Member
Mar 9, 2019
15
0
1
Ijamsville, MD
cPanel Access Level
Root Administrator
I have looked at the few threads regarding this error and none seem to apply to my case
Related or unrelated, I started getting the errors for one user:
User:lochhavenclubinc PID:8483 PPID:8335 Run Time:3(secs) Memory:309316(kb) RSS:42040(kb) exe:/opt/cpanel/ea-php72/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php72/root/usr/bin/php-cgi

and at the same time services like mysql, nameserver, clamd, spamd etc, failing and recovering.
Service check output looks like this

(XID 4jptke) The “clamd” service is down.
The subprocess “/usr/local/cpanel/scripts/restartsrv_clamd” reported error number 3 when it ended.

It all stopped at around 3 AM.
This is not the first time this happens, last time we had to suspend the user (which is actually us) and that stopped the issue.
The website for this user is a wordpress site, fully updated and working normally.
I am guessing we are being attacked some how, but that is just a wild guess.

Any ideas?
 

sparek-3

Well-Known Member
Aug 10, 2002
2,019
226
368
cPanel Access Level
Root Administrator
How many WordPress plugins do you have installed?

My best guess is that something within wp-cron is running overnight and is overloading your server. Unfortunately, I do not know what that something might be.
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,296
1,269
313
Houston
Hi @ContinuIT



User:lochhavenclubinc PID:8483 PPID:8335 Run Time:3(secs) Memory:309316(kb) RSS:42040(kb) exe:/opt/cpanel/ea-php72/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php72/root/usr/bin/php-cgi
What is the exact excessive error that is associated with this when CSF sends the notification? Is it excessive processes?

and at the same time services like mysql, nameserver, clamd, spamd etc, failing and recovering.
Service check output looks like this
This sounds a lot like something on the account in question here is consuming too many resources. You might check the daily process log if you're viewing the situation after the fact, it can be found at WHM>>Server Status>>Daily Process Log

You may also want to take a look at the post here: Tutorial - Troubleshooting high server loads on Linux servers