Process Time Notifications

[bsaverino]

We are new to CSF but have been on cPanel for a good amount of time now.

We are receiving a lot of notifications that we wouldn't expect and I'm not quite sure what to make of them and I was hoping someone might be able to explain a bit.

The Notifications are:

Code: Select all

Time:         Thu Sep 24 10:40:45 2015 -0500
Account:      main
Resource:     Process Time
Exceeded:     5446 > 1800 (seconds)
Executable:   /usr/bin/screen
Command Line: screen -r
PID:          3132 (Parent PID:3012)
Killed:       No

Time:         Thu Sep 24 10:40:45 2015 -0500
Account:      main
Resource:     Process Time
Exceeded:     5473 > 1800 (seconds)
Executable:   /bin/bash
Command Line: -bash
PID:          3012 (Parent PID:3010)
Killed:       No

Time:         Thu Sep 24 10:05:39 2015 -0500
Account:      main
Resource:     Process Time
Exceeded:     67484 > 1800 (seconds)
Executable:   /usr/bin/screen
Command Line: SCREEN -
PID:          12287 (Parent PID:12287)
Killed:       No

Time:         Thu Sep 24 10:05:39 2015 -0500
Account:      main
Resource:     Process Time
Exceeded:     67481 > 1800 (seconds)
Executable:   /bin/bash
Command Line: /bin/bash
PID:          12301 (Parent PID:12287)
Killed:       No

Screen I could understand but we killed the screen the was in process and its still reporting on it for some reason.

The other three seem odd that it would report on those. Do we miss something in the configuration? Or do we just need to add them to the pignore?

Any help is appreciated. Thank you in advance.

[maever]

Hello bsaverino,

I'm a big fan of CSF, for me it's an essential part in every Cpanel setup I build, but it will always require some tweaking to get right.

The notifications you are getting are from CSF's process tracking feature (in csf.conf), any (not in pignore listed) process that runs longer than the PT_USERTIME or goes over PT_USERMEM memory limit it will get reported to you by mail. This can come across a bit paranoid because not a lot of processes are ignored by default.
Sometimes a process might become a zombie and no longer be in the memory yet still gets reported.
In which case I would recommend looking here:
http://how-to.wikia.com/wiki/How_to_dis ... _processes

Personally I would recommend adding common used processes in your ignore list (screen would qualify as one).