Control Web Panel

Security => CSF Firewall => Topic started by: edur on November 13, 2017, 06:39:32 PM

Title: lfd on vpsxxxxxx.ovh.net: Excessive processes running under user xxxxxx
Post by: edur on November 13, 2017, 06:39:32 PM

What is it??
What can I do??

I received a lot mails with title "lfd on vps#####.ovh.net: Excessive processes running under user #####" and message

Code: [Select]


Time:          Mon Nov 13 18:10:06 2017 +0100
Account:       #####
Process Count: 12 (Not killed)

Process Information:

User:##### PID:19781 PPID:1642 Run Time:2(secs) Memory:201244(kb) RSS:47496(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php
User:##### PID:19782 PPID:1641 Run Time:2(secs) Memory:199188(kb) RSS:45424(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php
User:##### PID:19783 PPID:1640 Run Time:2(secs) Memory:199200(kb) RSS:45416(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php
User:##### PID:19784 PPID:2247 Run Time:2(secs) Memory:199200(kb) RSS:45412(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php
User:##### PID:19785 PPID:1640 Run Time:2(secs) Memory:196320(kb) RSS:42452(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php
User:##### PID:19786 PPID:2247 Run Time:2(secs) Memory:199200(kb) RSS:45416(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php
User:##### PID:19787 PPID:1642 Run Time:2(secs) Memory:199200(kb) RSS:45416(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php
User:##### PID:19788 PPID:1641 Run Time:1(secs) Memory:198628(kb) RSS:42448(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php
User:##### PID:19797 PPID:2247 Run Time:1(secs) Memory:183340(kb) RSS:29164(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php
User:##### PID:19798 PPID:2247 Run Time:1(secs) Memory:183340(kb) RSS:29168(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php
User:##### PID:19801 PPID:2247 Run Time:0(secs) Memory:178728(kb) RSS:24576(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php
User:##### PID:19802 PPID:2247 Run Time:0(secs) Memory:178800(kb) RSS:24608(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/#####/public_html/index.php


Title: Re: lfd on vpsxxxxxx.ovh.net: Excessive processes running under user xxxxxx
Post by: studio4host on November 14, 2017, 12:07:54 PM

you can simply add that process to csf/lfd ignore list if you allow it

in file /etc/csf/csf.pignore at end as new line add this
exe:/usr/local/bin/php-cgi

then restart lfd

Code: [Select]

service lfd restart

Title: Re: lfd on vpsxxxxxx.ovh.net: Excessive processes running under user xxxxxx
Post by: jksantos on November 29, 2017, 06:59:09 PM

I would like to disable the alert for a specific php file.

Example: disable the alert for cron.php, but leave it to others.

thank you

Title: Re: lfd on vpsxxxxxx.ovh.net: Excessive processes running under user xxxxxx
Post by: 24x7servermanagement on November 29, 2017, 08:38:47 PM

You can whitelist your PHP script by adding fullpath in below file, or you can also add user to ignore files in ownership of a particular user.

    /etc/csf/csf.fignore