Learn about Centmin Mod LEMP Stack today
Become a Member

lfd Alert - Excessive resource usage

Discussion in 'Install & Upgrades or Pre-Install Questions' started by Doni, Feb 2, 2017.

Tags:
  1. Doni

    Doni New Member

    29
    1
    3
    Aug 23, 2014
    Ratings:
    +3
    Local Time:
    5:40 PM
    nginx/1.7.4
    mysql Ver 15.1 Distrib 5.5.39-MariaDB, for Linux (x86_64) using readline 5.1
    Hi Eva,

    This is kinda strange because i receive a lot of mail telling that nginx using excessive resources from lfd.

    Code (Text):
    [root@hifo conf]# mail
    Heirloom Mail version 12.5 7/5/10.  Type ? for help.
    "/var/spool/mail/root": 178 messages 156 unread
        1 root@hifo.localdomai  Wed Feb  1 12:16  22/807   "lfd on hifo: Excessive resource usage: nginx (32050 (Parent PID:27767))"
        2 root@hifo.localdomai  Wed Feb  1 12:17  22/807   "lfd on hifo: Excessive resource usage: nginx (32061 (Parent PID:27767))"
        3 root@hifo.localdomai  Wed Feb  1 12:18 217/16902 "lfd on hifo: Suspicious process running under user postfix"
        4 root@hifo.localdomai  Wed Feb  1 12:18  22/807   "lfd on hifo: Excessive resource usage: nginx (32089 (Parent PID:27767))"
        5 root@hifo.localdomai  Wed Feb  1 12:20  22/807   "lfd on hifo: Excessive resource usage: nginx (32123 (Parent PID:27767))"
        6 root@hifo.localdomai  Wed Feb  1 12:30  22/767   "lfd on hifo: Excessive resource usage: postfix (31679 (Parent PID:702))"
        7 root@hifo.localdomai  Wed Feb  1 12:39  22/807   "lfd on hifo: Excessive resource usage: nginx (32289 (Parent PID:27767))"
        8 root@hifo.localdomai  Wed Feb  1 12:39  22/807   "lfd on hifo: Excessive resource usage: nginx (32286 (Parent PID:27767))"
        9 root@hifo.localdomai  Wed Feb  1 12:41  22/807   "lfd on hifo: Excessive resource usage: nginx (32318 (Parent PID:27767))"
       10 root@hifo.localdomai  Wed Feb  1 12:43  22/807   "lfd on hifo: Excessive resource usage: nginx (32335 (Parent PID:27767))"
       11 root@hifo.localdomai  Wed Feb  1 12:44  22/807   "lfd on hifo: Excessive resource usage: nginx (32352 (Parent PID:27767))"


    Checking the PT_USERMEM with:
    Code (Text):
    [root@hifo conf]# nano /etc/csf/csf.conf


    And i think it set to enough value.
    Code (Text):
    # This User Process Tracking option sends an alert if any user process exceeds
    # the virtual memory usage set (MB). To ignore specific processes or users use
    # csf.pignore
    #
    # Set to 0 to disable this feature
    PT_USERMEM = "512"


    Finally i try to ignore it on csf.pignore

    Code (Text):
    # It is strongly recommended that you use command line ignores very carefully
    # as any process can change what is reported to the OS.
    #
    # For more information see readme.txt
    
    exe:/bin/dbus-daemon
    exe:/sbin/ntpd
    exe:/usr/bin/dbus-daemon
    exe:/usr/bin/lsmd
    exe:/usr/lib/courier-imap/bin/imapd
    exe:/usr/lib/courier-imap/bin/pop3d
    exe:/usr/lib/polkit-1/polkitd
    exe:/usr/libexec/dovecot/imap
    exe:/usr/libexec/dovecot/imap
    exe:/usr/libexec/dovecot/pop3
    exe:/usr/libexec/dovecot/pop3
    exe:/usr/libexec/mysqld
    exe:/usr/local/apache/bin/httpd
    exe:/usr/local/libexec/dovecot/imap
    exe:/usr/local/libexec/dovecot/imap-login
    exe:/usr/local/libexec/dovecot/pop3
    exe:/usr/local/libexec/dovecot/pop3-login
    exe:/usr/sbin/chronyd
    exe:/usr/sbin/exim
    exe:/usr/sbin/exim4
    exe:/usr/sbin/named
    exe:/usr/sbin/nscd
    exe:/usr/sbin/ntpd
    exe:/usr/sbin/ntpd
    exe:/usr/sbin/proftpd
    exe:/usr/sbin/pure-ftpd
    exe:/usr/sbin/sshd
    exe:/usr/sbin/mysqld
    exe:/usr/sbin/postfix
    exe:/usr/local/sbin/nginx


    And i still receieve the mail that warn about this Excessive resource usage. Do you know how to fix this? or is it totally safe to ignore this alert?
    --
    Please fill in any relevant information that applies to you:
    • CentOS Version: CentOS 7 64bit
    • Centmin Mod Version Installed: 123.09beta01
    • Nginx Version Installed: i.e. 1.11.9
    • PHP Version Installed: 5.6.30
    • MariaDB MySQL Version Installed: 10.1.21-MariaDB
    • When was last time updated Centmin Mod code base ? : Today
     
  2. eva2000

    eva2000 Administrator Staff Member

    28,950
    6,572
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,753
    Local Time:
    8:40 PM
    Nginx 1.13.x
    MariaDB 5.5
    strange that isn't Centmin Mod's default /etc/csf/csf.pignore file that 123.09beta01 sets up it's this
    Code (Text):
    pexe:/usr/local/lsws/bin/lshttpd.*
    pexe:/usr/local/lsws/fcgi-bin/lsphp.*
    exe:/usr/local/bin/memcached
    cmd:/usr/local/bin/memcached
    user:mysql
    exe:/usr/sbin/mysqld 
    cmd:/usr/sbin/mysqld
    user:varnish
    exe:/usr/sbin/varnishd
    cmd:/usr/sbin/varnishd
    exe:/sbin/portmap
    cmd:portmap
    exe:/usr/libexec/gdmgreeter
    cmd:/usr/libexec/gdmgreeter
    exe:/usr/sbin/avahi-daemon
    cmd:avahi-daemon
    exe:/sbin/rpc.statd
    cmd:rpc.statd
    exe:/usr/libexec/hald-addon-acpi
    cmd:hald-addon-acpi
    user:nsd
    user:nginx
    user:ntp
    user:dbus
    user:smmsp
    user:postfix
    user:dovecot
    user:www-data
    user:spamfilter
    exe:/usr/libexec/dovecot/imap
    exe:/usr/libexec/dovecot/pop3
    exe:/usr/libexec/dovecot/anvil
    exe:/usr/libexec/dovecot/auth
    exe:/usr/libexec/dovecot/pop3-login
    exe:/usr/libexec/dovecot/imap-login
    exe:/usr/libexec/postfix
    exe:/usr/libexec/postfix/bounce
    exe:/usr/libexec/postfix/discard
    exe:/usr/libexec/postfix/error
    exe:/usr/libexec/postfix/flush
    exe:/usr/libexec/postfix/local
    exe:/usr/libexec/postfix/smtp
    exe:/usr/libexec/postfix/smtpd
    exe:/usr/libexec/postfix/pickup
    exe:/usr/libexec/postfix/tlsmgr
    exe:/usr/libexec/postfix/qmgr
    exe:/usr/libexec/postfix/virtual
    exe:/usr/libexec/postfix/proxymap
    exe:/usr/libexec/postfix/anvil
    exe:/usr/libexec/postfix/lmtp
    exe:/usr/libexec/postfix/scache
    exe:/usr/libexec/postfix/cleanup
    exe:/usr/libexec/postfix/trivial-rewrite
    exe:/usr/libexec/postfix/master
    

    as it's a fresh initial install might want to check the install log.

    To troubleshoot initial installation, you need to check the initial install log at /root/centminlogs and instructions under Sharing logs and errors heading for using Pastebin.com or Gists to share a sanitised version of the contents of the initial install log. You can see full details at How to troubleshoot Centmin Mod initial install issues

    Example list /root/centminlogs files in date ascending order and grep for install.log
    Code (Text):
    ls -lahrt /root/centminlogs | grep install.log
    

    example output returns install log at /root/centminlogs/centminmod_1.2.3-eva2000.09.001_111016-112321_install.log
    Code (Text):
    ls -lahrt /root/centminlogs | grep install.log
    -rw-r--r--  1 root root 2.2M Oct 11 01:40 centminmod_1.2.3-eva2000.09.001_111016-112321_install.log
    

    in SSH use cat to ouput contents of /root/centminlogs/centminmod_1.2.3-eva2000.09.001_111016-112321_install.log. Clear your SSH client window/buffer so only output is the contents of the file
    Code (Text):
    cat /root/centminlogs/centminmod_1.2.3-eva2000.09.001_111016-112321_install.log
    

    Then copy and paste into Pastebin.com or Gists entry. If your SSH window scroll buffer isn't that large to get the whole contents of the install log, you can download file manually and copy and paste contents. But makes sure it's sanitised version of the contents of the initial install log as outlined at How to troubleshoot Centmin Mod initial install issues
     
  3. Doni

    Doni New Member

    29
    1
    3
    Aug 23, 2014
    Ratings:
    +3
    Local Time:
    5:40 PM
    nginx/1.7.4
    mysql Ver 15.1 Distrib 5.5.39-MariaDB, for Linux (x86_64) using readline 5.1
    Hi eva, This is the log
    Code (Text):
    https://gist.github.com/anonymous/ba7a30ff83e5ef40196e136163a76849
     
  4. eva2000

    eva2000 Administrator Staff Member

    28,950
    6,572
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,753
    Local Time:
    8:40 PM
    Nginx 1.13.x
    MariaDB 5.5
    seems had issues with CSF install and setup at initial install

    post install check list shows
    Code (Text):
    --------------------------------------------------------
    Check CSF Firewall Version:
    --------------------------------------------------------
    You have an unresolved error when starting csf:
    Error: FASTSTART: (Packet Filter IPv4) [] [iptables-restore: line 14 failed]. Try restarting csf with FASTSTART disabled, at line 5046 in /usr/sbin/csf
    
    You need to restart csf successfully to remove this warning, or delete /etc/csf/csf.error
    

    what output do you get for this command
    Code (Text):
    perl /etc/csf/csftest.pl
    

    wrap in CODE or CODEB tags
     
  5. eva2000

    eva2000 Administrator Staff Member

    28,950
    6,572
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +9,753
    Local Time:
    8:40 PM
    Nginx 1.13.x
    MariaDB 5.5
    problem most likely your OpenVZ VPS is missing kernel modules required by CSF Firewall see iptables failed to start on new Centos 7 server - Page 3 - CentOS

    would need to contact web host to get them to install the missing modules on the OpenVZ host node so your VPS has access

    then i'd do a fresh OS reload and new centmin mod install

    who's your web host ?