lfd on xyz.com: Excessive resource usage: nagios

[phoenixgmn]

Hi

We are receiving "lfd on [our server]: Excessive resource usage: nagios" emails from one of our servers every hour. Our CSF version is
"csf v6.11"

Content of email is:
Time: Sun Jun 2 01:00:38 2013 +0100
Account: nagios
Resource: Process Time
Exceeded: 42890 > 1800 (seconds)

Executable: /usr/sbin/nrpe
Command Line: /usr/sbin/nrpe -c /etc/nrpe.cfg -d
PID: 3247 (Parent PID:3247)
Killed: No

Can anyone please recommend/advise any solution?

Cheers!
-N

[Sergio]

Upgrade to the latest v6.13

[phoenixgmn]

And we are also getting this now every hour

" Suspicious process running under user nagios"

Time: Sun Jun 2 13:12:10 2013 +0100
PID: 3247 (Parent PID:3247)
Account: nagios
Uptime: 86783 seconds
Executable:
/usr/sbin/nrpe
Command Line (often faked in exploits):
/usr/sbin/nrpe -c /etc/nrpe.cfg -d
Network connections by the process (if any):
tcp: 0.0.0.0:5666 -> 0.0.0.0:0
Files open by the process (if any):
/dev/null
/dev/null
/dev/null

[phoenixgmn]

Any help guys?

Also on my CSF screen it says

"You are running the latest version of csf. An Upgrade button will appear here if a new version becomes available"

-N

[phoenixgmn]

we are still receiving Excessive resource usage: and Suspicious process emails every hour.. any help guys? Can I disable this process? will it harm the server/cpanel/csf functionality?

-N

[Sergio]

What is nagios? Is it a process that you trust?

If so, you can add ONE of the following lines to the CSF.PIGNORE:
user:nagios
exe:/usr/sbin/nrpe
cmd:/usr/sbin/nrpe -c /etc/nrpe.cfg -d

Doing this you will not be receive any more emails about nagios.

Sergio

[phoenixgmn]

Hi Sergio

Thanks for your reply. My google search about nagios tells me that it monitors other processes including CSf and LFD etc. I don't want to stop receiving emails about it. I want to solve the problem which is making it use so much resources or being caught as suspicious process. Its because of so much resource usage, our server becomes unresponsive at time. We have 4GB ram on our server but it still becomes unresponsive at times and we keep getting above mentioned emails about nagios!

-N

[Sergio]

Just give it a try adding the following line to CSF.PIGNORE:
user:nagios

As far as I can see, the email is reporting the "process uptime", it is not reporting the memory used or load caused by nagios.

So, the problem of your server getting unresponsive has to be something else, just my 2 cents.