Process Time Exceeded question

[parisi]

I am trying to understand what the Exceeded number below actually means. I am assuming that it means the process has run for 219,000 seconds, which exceeds the threshold of 1800.

Isn't it a good thing that MySQL is running all the time.

So what does the code expect that monitors process time? I guess the logic is if something runs for more than 1800 seconds, it's run too long. It seems that, in the case of MySQL, the logic should not be valid.

Why would the rule that causes this alert every be enabled by default for MySQL?

Code: Select all

Time:         Fri Apr 21 18:56:57 2017 -0400
Account:      mysql
Resource:     Process Time
Exceeded:     219473 > 1800 (seconds)
Executable:   /usr/bin/bash
Command Line: /bin/sh /usr/bin/mysqld_safe
PID:          4066 (Parent PID:4066)
Killed:       No

[Sergio]

When you configure CSF you set the time that all processes without exceptions should be running, mostly to protect your server against bad scripts that your users run and consumes server resources. Unfortunately that contains processes that should not be blocked or warn you about and that is why CSF.PIGNORE is for.

In there you write the processes that LFD should not be warning you about, for example, in your excerpt you see that MYSQL (username) has been running for 219473 seconds instead of 1800. So, you should add the following line to your CSF.PIGNORE:
user:mysql
adding that line you are telling CSF to ignore the processes from MYSQL and not report them..
You can add as many lines as necessary but just be careful on what you add.

Sergio

[parisi]

Sergio - thanks so much for the reply. I have been trying to get this answer for quite some time.

This seems to me to be a bad default, specifically for MySQL, for a hosting server. Do you know why that would be set as a default?

[Sergio]

Can you please elaborate a little bit more about:

This seems to me to be a bad default, specifically for MySQL, for a hosting server. Do you know why that would be set as a default?

Where are you looking at the "default"?

[parisi]

I guess I mean that the default is 1800 seconds for any process. Hence, MySQL, which we want to run forever, will always be flagged on a web host.

So, I guess the default should be to ignore MySQL... or at least this should be recommended in the installation guide.

[Sergio]

CSF is a FireWall, a really good one and is intended for people that knows a little bit about servers, so, this sort of things can not be written on the readme file.

On the other hand, when you pay ConfigServer for the installation, they set all the options for you.