Author Topic: How to Fix this (Excessive processes running under user glizlk)  (Read 766 times)

0 Members and 1 Guest are viewing this topic.

Offline
*
How to Fix this (Excessive processes running under user glizlk)
« on: December 15, 2023, 01:59:37 PM »
I received this email more than once. How can I resolve this?


Time:          Thu Dec 14 20:49:44 2023 +0800
Account:       glizlk
Process Count: 15 (Not killed)

Process Information:

User:glizlk PID:30200 PPID:15851 Run Time:28(secs) Memory:566108(kb) RSS:149648(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/wp-admin/admin-ajax.php
User:glizlk PID:30235 PPID:15851 Run Time:13(secs) Memory:494440(kb) RSS:158232(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30238 PPID:16601 Run Time:11(secs) Memory:482000(kb) RSS:146660(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30241 PPID:15265 Run Time:9(secs) Memory:469580(kb) RSS:133920(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30246 PPID:15851 Run Time:7(secs) Memory:446544(kb) RSS:110616(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30251 PPID:16601 Run Time:6(secs) Memory:421836(kb) RSS:84192(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30255 PPID:16601 Run Time:4(secs) Memory:398516(kb) RSS:63536(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30256 PPID:16601 Run Time:4(secs) Memory:400564(kb) RSS:64884(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30257 PPID:16601 Run Time:4(secs) Memory:377524(kb) RSS:42328(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30258 PPID:15265 Run Time:4(secs) Memory:396468(kb) RSS:61232(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30259 PPID:16601 Run Time:4(secs) Memory:388276(kb) RSS:52624(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30262 PPID:15851 Run Time:2(secs) Memory:373428(kb) RSS:38376(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30263 PPID:15263 Run Time:2(secs) Memory:377536(kb) RSS:42552(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/wp-admin/admin-ajax.php
User:glizlk PID:30266 PPID:15264 Run Time:1(secs) Memory:360820(kb) RSS:26016(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php
User:glizlk PID:30269 PPID:15851 Run Time:0(secs) Memory:354436(kb) RSS:18096(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/glizlk/public_html/index.php

Offline
****
Re: How to Fix this (Excessive processes running under user glizlk)
« Reply #1 on: December 15, 2023, 08:26:40 PM »
You can mute the error in /etc/csf/csf.pignore -- but it may be indicative that you need more memory on your server. What are your resources (CPU, memory, disk)?

Offline
****
Re: How to Fix this (Excessive processes running under user glizlk)
« Reply #2 on: December 15, 2023, 10:00:21 PM »
Find PT_USERPROC in the /etc/csf/csf.conf file.  You can change it form 15 to a greater value.  I have mine set to 40
Google Hangouts:  rcschaff82@gmail.com

Offline
****
Re: How to Fix this (Excessive processes running under user glizlk)
« Reply #3 on: December 16, 2023, 03:53:11 AM »
Code: [Select]
# Set to 0 to disable this feature
PT_USERPROC = "0"

Offline
****
Re: How to Fix this (Excessive processes running under user glizlk)
« Reply #4 on: December 16, 2023, 04:23:08 AM »
Code: [Select]
# Set to 0 to disable this feature
PT_USERPROC = "0"
I wouldn't recommend disabling it all together.  A virus will spawn 100's of services and once, and this might be the only way to tell.  JS
Google Hangouts:  rcschaff82@gmail.com