/ Register

Get the most out of your Centmin Mod LEMP stack
Become a Member

lfd Alert - Excessive resource usage

Discussion in 'Install & Upgrades or Pre-Install Questions' started by Doni, Feb 2, 2017.

Tags:
Previous Thread Next Thread
Loading...
  1. Feb 2, 2017 #1
    Doni

    Doni Member

    45
    2
    8
    Aug 23, 2014
    Ratings:
    +5
    Local Time:
    11:02 AM
    nginx/1.7.4
    mysql Ver 15.1 Distrib 5.5.39-MariaDB, for Linux (x86_64) using readline 5.1
    Hi Eva,

    This is kinda strange because i receive a lot of mail telling that nginx using excessive resources from lfd.

    Code (Text):
    [root@hifo conf]# mail
Heirloom Mail version 12.5 7/5/10.  Type ? for help.
"/var/spool/mail/root": 178 messages 156 unread
    1 root@hifo.localdomai  Wed Feb  1 12:16  22/807   "lfd on hifo: Excessive resource usage: nginx (32050 (Parent PID:27767))"
    2 root@hifo.localdomai  Wed Feb  1 12:17  22/807   "lfd on hifo: Excessive resource usage: nginx (32061 (Parent PID:27767))"
    3 root@hifo.localdomai  Wed Feb  1 12:18 217/16902 "lfd on hifo: Suspicious process running under user postfix"
    4 root@hifo.localdomai  Wed Feb  1 12:18  22/807   "lfd on hifo: Excessive resource usage: nginx (32089 (Parent PID:27767))"
    5 root@hifo.localdomai  Wed Feb  1 12:20  22/807   "lfd on hifo: Excessive resource usage: nginx (32123 (Parent PID:27767))"
    6 root@hifo.localdomai  Wed Feb  1 12:30  22/767   "lfd on hifo: Excessive resource usage: postfix (31679 (Parent PID:702))"
    7 root@hifo.localdomai  Wed Feb  1 12:39  22/807   "lfd on hifo: Excessive resource usage: nginx (32289 (Parent PID:27767))"
    8 root@hifo.localdomai  Wed Feb  1 12:39  22/807   "lfd on hifo: Excessive resource usage: nginx (32286 (Parent PID:27767))"
    9 root@hifo.localdomai  Wed Feb  1 12:41  22/807   "lfd on hifo: Excessive resource usage: nginx (32318 (Parent PID:27767))"
   10 root@hifo.localdomai  Wed Feb  1 12:43  22/807   "lfd on hifo: Excessive resource usage: nginx (32335 (Parent PID:27767))"
   11 root@hifo.localdomai  Wed Feb  1 12:44  22/807   "lfd on hifo: Excessive resource usage: nginx (32352 (Parent PID:27767))"


    Checking the PT_USERMEM with:
    Code (Text):
    [root@hifo conf]# nano /etc/csf/csf.conf


    And i think it set to enough value.
    Code (Text):
    # This User Process Tracking option sends an alert if any user process exceeds
# the virtual memory usage set (MB). To ignore specific processes or users use
# csf.pignore
#
# Set to 0 to disable this feature
PT_USERMEM = "512"


    Finally i try to ignore it on csf.pignore

    Code (Text):
    # It is strongly recommended that you use command line ignores very carefully
# as any process can change what is reported to the OS.
#
# For more information see readme.txt

exe:/bin/dbus-daemon
exe:/sbin/ntpd
exe:/usr/bin/dbus-daemon
exe:/usr/bin/lsmd
exe:/usr/lib/courier-imap/bin/imapd
exe:/usr/lib/courier-imap/bin/pop3d
exe:/usr/lib/polkit-1/polkitd
exe:/usr/libexec/dovecot/imap
exe:/usr/libexec/dovecot/imap
exe:/usr/libexec/dovecot/pop3
exe:/usr/libexec/dovecot/pop3
exe:/usr/libexec/mysqld
exe:/usr/local/apache/bin/httpd
exe:/usr/local/libexec/dovecot/imap
exe:/usr/local/libexec/dovecot/imap-login
exe:/usr/local/libexec/dovecot/pop3
exe:/usr/local/libexec/dovecot/pop3-login
exe:/usr/sbin/chronyd
exe:/usr/sbin/exim
exe:/usr/sbin/exim4
exe:/usr/sbin/named
exe:/usr/sbin/nscd
exe:/usr/sbin/ntpd
exe:/usr/sbin/ntpd
exe:/usr/sbin/proftpd
exe:/usr/sbin/pure-ftpd
exe:/usr/sbin/sshd
exe:/usr/sbin/mysqld
exe:/usr/sbin/postfix
exe:/usr/local/sbin/nginx


    And i still receieve the mail that warn about this Excessive resource usage. Do you know how to fix this? or is it totally safe to ignore this alert?
    --
    Please fill in any relevant information that applies to you:
    • CentOS Version: CentOS 7 64bit
    • Centmin Mod Version Installed: 123.09beta01
    • Nginx Version Installed: i.e. 1.11.9
    • PHP Version Installed: 5.6.30
    • MariaDB MySQL Version Installed: 10.1.21-MariaDB
    • When was last time updated Centmin Mod code base ? : Today
     
  2. Feb 2, 2017 #2
    eva2000

    eva2000 Administrator Staff Member

    55,189
    12,251
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,829
    Local Time:
    2:02 PM
    Nginx 1.27.x
    MariaDB 10.x/11.4+
    strange that isn't Centmin Mod's default /etc/csf/csf.pignore file that 123.09beta01 sets up it's this
    Code (Text):
    pexe:/usr/local/lsws/bin/lshttpd.*
pexe:/usr/local/lsws/fcgi-bin/lsphp.*
exe:/usr/local/bin/memcached
cmd:/usr/local/bin/memcached
user:mysql
exe:/usr/sbin/mysqld 
cmd:/usr/sbin/mysqld
user:varnish
exe:/usr/sbin/varnishd
cmd:/usr/sbin/varnishd
exe:/sbin/portmap
cmd:portmap
exe:/usr/libexec/gdmgreeter
cmd:/usr/libexec/gdmgreeter
exe:/usr/sbin/avahi-daemon
cmd:avahi-daemon
exe:/sbin/rpc.statd
cmd:rpc.statd
exe:/usr/libexec/hald-addon-acpi
cmd:hald-addon-acpi
user:nsd
user:nginx
user:ntp
user:dbus
user:smmsp
user:postfix
user:dovecot
user:www-data
user:spamfilter
exe:/usr/libexec/dovecot/imap
exe:/usr/libexec/dovecot/pop3
exe:/usr/libexec/dovecot/anvil
exe:/usr/libexec/dovecot/auth
exe:/usr/libexec/dovecot/pop3-login
exe:/usr/libexec/dovecot/imap-login
exe:/usr/libexec/postfix
exe:/usr/libexec/postfix/bounce
exe:/usr/libexec/postfix/discard
exe:/usr/libexec/postfix/error
exe:/usr/libexec/postfix/flush
exe:/usr/libexec/postfix/local
exe:/usr/libexec/postfix/smtp
exe:/usr/libexec/postfix/smtpd
exe:/usr/libexec/postfix/pickup
exe:/usr/libexec/postfix/tlsmgr
exe:/usr/libexec/postfix/qmgr
exe:/usr/libexec/postfix/virtual
exe:/usr/libexec/postfix/proxymap
exe:/usr/libexec/postfix/anvil
exe:/usr/libexec/postfix/lmtp
exe:/usr/libexec/postfix/scache
exe:/usr/libexec/postfix/cleanup
exe:/usr/libexec/postfix/trivial-rewrite
exe:/usr/libexec/postfix/master

    as it's a fresh initial install might want to check the install log.

    To troubleshoot initial installation, you need to check the initial install log at /root/centminlogs and instructions under Sharing logs and errors heading for using Pastebin.com or Gists to share a sanitised version of the contents of the initial install log. You can see full details at How to troubleshoot Centmin Mod initial install issues

    Example list /root/centminlogs files in date ascending order and grep for install.log
    Code (Text):
    ls -lahrt /root/centminlogs | grep install.log

    example output returns install log at /root/centminlogs/centminmod_1.2.3-eva2000.09.001_111016-112321_install.log
    Code (Text):
    ls -lahrt /root/centminlogs | grep install.log
-rw-r--r--  1 root root 2.2M Oct 11 01:40 centminmod_1.2.3-eva2000.09.001_111016-112321_install.log

    in SSH use cat to ouput contents of /root/centminlogs/centminmod_1.2.3-eva2000.09.001_111016-112321_install.log. Clear your SSH client window/buffer so only output is the contents of the file
    Code (Text):
    cat /root/centminlogs/centminmod_1.2.3-eva2000.09.001_111016-112321_install.log

    Then copy and paste into Pastebin.com or Gists entry. If your SSH window scroll buffer isn't that large to get the whole contents of the install log, you can download file manually and copy and paste contents. But makes sure it's sanitised version of the contents of the initial install log as outlined at How to troubleshoot Centmin Mod initial install issues
     
  3. Feb 2, 2017 #3
    Doni

    Doni Member

    45
    2
    8
    Aug 23, 2014
    Ratings:
    +5
    Local Time:
    11:02 AM
    nginx/1.7.4
    mysql Ver 15.1 Distrib 5.5.39-MariaDB, for Linux (x86_64) using readline 5.1
    Hi eva, This is the log
    Code (Text):
    https://gist.github.com/anonymous/ba7a30ff83e5ef40196e136163a76849
     
  4. Feb 2, 2017 #4
    eva2000

    eva2000 Administrator Staff Member

    55,189
    12,251
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,829
    Local Time:
    2:02 PM
    Nginx 1.27.x
    MariaDB 10.x/11.4+
    seems had issues with CSF install and setup at initial install

    post install check list shows
    Code (Text):
    --------------------------------------------------------
Check CSF Firewall Version:
--------------------------------------------------------
You have an unresolved error when starting csf:
Error: FASTSTART: (Packet Filter IPv4) [] [iptables-restore: line 14 failed]. Try restarting csf with FASTSTART disabled, at line 5046 in /usr/sbin/csf

You need to restart csf successfully to remove this warning, or delete /etc/csf/csf.error

    what output do you get for this command
    Code (Text):
    perl /etc/csf/csftest.pl

    wrap in CODE or CODEB tags
     
  5. Feb 2, 2017 #5
    eva2000

    eva2000 Administrator Staff Member

    55,189
    12,251
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,829
    Local Time:
    2:02 PM
    Nginx 1.27.x
    MariaDB 10.x/11.4+
    problem most likely your OpenVZ VPS is missing kernel modules required by CSF Firewall see iptables failed to start on new Centos 7 server - Page 3 - CentOS

    would need to contact web host to get them to install the missing modules on the OpenVZ host node so your VPS has access

    then i'd do a fresh OS reload and new centmin mod install

    who's your web host ?
     
Previous Thread Next Thread
Loading...

.