lfd excessive resource usage warnings with litespeed

[xfactor5]

Hi,
I have been getting excessive resource usage warnings from lfd like this:

Time:         Tue Apr 24 17:03:54 2018 +0430
Account:      kw179
Resource:     Process Time
Exceeded:     1811 > 1800 (seconds)
Executable:  /opt/cpanel/ea-php71/root/usr/bin/lsphp
Command Line: lsphp                                 
PID:          7845 (Parent PID:7783)
Killed:       No

This happens to websites with a high number of visitors, I am using Litespeed + suPHP with LSAPI.

In order to stop these errors I tried adding these to csf.pignore but none of them has been effective. I also searched online and found nothing:

exe: /opt/cpanel/ea-php71/root/usr/bin/lsphp
pexe: /opt/cpanel/ea-php71/root/usr/bin/lsphp
cmd: /opt/cpanel/ea-php71/root/usr/bin/lsphp
pcmd: /opt/cpanel/ea-php71/root/usr/bin/lsphp
cmd: lsphp

None of them stopped the issue. Can anybody help?
Thanks

 

[cPanelLauren]

Hello,

adding them to the pignore list should have resolved the issue. Please keep in mind CSF is a 3rd party software. They do have some threads similar to this issue such as this one Process Tracking and csf.pignore - ConfigServer Community Forum which may be helpful with your issue.


Thank you,

 

[eugenevdm.host]

Hi @cPanelLauren,

What is the "default" or recommended firewall with WHM? We're also using Litespeed, and CSF, and we're getting these warnings, but I'd rather stay away from using 3rd party software if I can't get support from cPanel.

 

[cPanelLauren]

CSF is the most commonly used firewall but like almost any software it requires configuration. In some instances, 3rd party software is an inevitability, as we don't officially support any firewall software, just due to the impact it can have if we were to make changes.

I wrote that article for these specific types of warnings - if you're receiving the same one they can be safely ignored, it is a good idea to perform some due diligence prior to ignoring them and ensuring that the process is in fact legitimate if it is not the identical process listed.