How to Fix this (Excessive processes running under user glizlk)

I received this email more than once. How can I resolve this?


Time:          Thu Dec 14 20:49:44 2023 +0800
Account:       glizlk
Process Count: 15 (Not killed)

Process Information:

User:glizlk PID:30200 PPID:15851 Run Time:28(secs) Memory:566108(kb) RSS:149648(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/wp-admin/admin-ajax.php
User:glizlk PID:30235 PPID:15851 Run Time:13(secs) Memory:494440(kb) RSS:158232(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30238 PPID:16601 Run Time:11(secs) Memory:482000(kb) RSS:146660(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30241 PPID:15265 Run Time:9(secs) Memory:469580(kb) RSS:133920(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30246 PPID:15851 Run Time:7(secs) Memory:446544(kb) RSS:110616(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30251 PPID:16601 Run Time:6(secs) Memory:421836(kb) RSS:84192(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30255 PPID:16601 Run Time:4(secs) Memory:398516(kb) RSS:63536(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30256 PPID:16601 Run Time:4(secs) Memory:400564(kb) RSS:64884(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30257 PPID:16601 Run Time:4(secs) Memory:377524(kb) RSS:42328(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30258 PPID:15265 Run Time:4(secs) Memory:396468(kb) RSS:61232(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30259 PPID:16601 Run Time:4(secs) Memory:388276(kb) RSS:52624(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30262 PPID:15851 Run Time:2(secs) Memory:373428(kb) RSS:38376(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30263 PPID:15263 Run Time:2(secs) Memory:377536(kb) RSS:42552(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/wp-admin/admin-ajax.php
User:glizlk PID:30266 PPID:15264 Run Time:1(secs) Memory:360820(kb) RSS:26016(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30269 PPID:15851 Run Time:0(secs) Memory:354436(kb) RSS:18096(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php

You can mute the error in /etc/csf/csf.pignore -- but it may be indicative that you need more memory on your server. What are your resources (CPU, memory, disk)?

Find PT_USERPROC in the /etc/csf/csf.conf file.  You can change it form 15 to a greater value.  I have mine set to 40

Code: [Select]

# Set to 0 to disable this feature
PT_USERPROC = "0"

Code: [Select]

# Set to 0 to disable this feature
PT_USERPROC = "0"

I wouldn't recommend disabling it all together.  A virus will spawn 100's of services and once, and this might be the only way to tell.  JS