Suspicious process running under user php-fm

ksgalicia

Well-Known Member
Aug 4, 2016
66
5
8
Spain
cPanel Access Level
Root Administrator
Twitter
Hello! I have a problem. I am receiving many notices from the CSF and the user's website is saturated ... Solution?

Executable:

/opt/cpanel/ea-php74/root/usr/sbin/php-fpm

Command Line (often faked in exploits):

php-fpm: pool domain_es

Network connections by the process (if any):

tcp6: 0:0:0:0:0:0:0:1:50484 -> 2a00:1450:4003:800:0:0:0:200e:443

Thanks!
 
Last edited by a moderator:

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
4,968
612
273
cPanel Access Level
Root Administrator
Hey there! Are these the "excessive resource usage" notifications? If so, and you are also seeing slowness on the site, you may want to ensure the website is not experiencing an attack of some sort. We have a guide on how to perform that work here:


and a guide on how to setup protection from that here:


Can you check and see if that is what is happening with your system?