lfd excessive processes running under user

[ContinuIT]

I have looked at the few threads regarding this error and none seem to apply to my case
Related or unrelated, I started getting the errors for one user:
User:lochhavenclubinc PID:8483 PPID:8335 Run Time:3(secs) Memory:309316(kb) RSS:42040(kb) exe:/opt/cpanel/ea-php72/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php72/root/usr/bin/php-cgi

and at the same time services like mysql, nameserver, clamd, spamd etc, failing and recovering.
Service check output looks like this

(XID 4jptke) The “clamd” service is down.
The subprocess “/usr/local/cpanel/scripts/restartsrv_clamd” reported error number 3 when it ended.

It all stopped at around 3 AM.
This is not the first time this happens, last time we had to suspend the user (which is actually us) and that stopped the issue.
The website for this user is a wordpress site, fully updated and working normally.
I am guessing we are being attacked some how, but that is just a wild guess.

Any ideas?

 

[sparek-3]

How many WordPress plugins do you have installed?

My best guess is that something within wp-cron is running overnight and is overloading your server. Unfortunately, I do not know what that something might be.

 

[ContinuIT]

I have just 13 plugins running, not a lot for a wordpress site.
Is there a log of the wp-cron somewhere?

 

[cPanelLauren]

Hi @ContinuIT

User:lochhavenclubinc PID:8483 PPID:8335 Run Time:3(secs) Memory:309316(kb) RSS:42040(kb) exe:/opt/cpanel/ea-php72/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php72/root/usr/bin/php-cgi

What is the exact excessive error that is associated with this when CSF sends the notification? Is it excessive processes?

and at the same time services like mysql, nameserver, clamd, spamd etc, failing and recovering.
Service check output looks like this

This sounds a lot like something on the account in question here is consuming too many resources. You might check the daily process log if you're viewing the situation after the fact, it can be found at WHM>>Server Status>>Daily Process Log

You may also want to take a look at the post here: Tutorial - Troubleshooting high server loads on Linux servers

 

[sparek-3]

The only way I know of to list wp-cron events is through wp-cli

wp cron event list | WordPress Developer Resources

It's just a guess on my part that it is something to do with wp-cron. You may have something trying to perform a backup at that time and it's consuming all of the memory. But I really don't know.

 

[ContinuIT]

Well, it stopped doing it. This has happened in the past as well, we get the issue going for 2 days and then it stop and we don't know what we did or if it was even us that fixed it.