Page 1 of 1

Handling with Excessive and Suspicious processes

Posted: 07 Aug 2017, 09:37
by NPH
Hello,

I have the following case here with my CSF. It is able to find a suspicious and excessive processes running on the server, but it does not kill/stop them. For example :

Time: Mon Aug 7 10:13:26 2017 +0300
Account: username
Process Count: 20 (Not killed)

Process Information:

User:username PID:3806 PPID:3343 Run Time:2469(secs) Memory:482564(kb) RSS:55036(kb) exe:/opt/alt/php56/usr/bin/php-cgi cmd:/opt/cpanel/ea-php56/root/usr/bin/php-cgi /home/username/public_html/website/index.php

And there are 20-30 more processes with the same, but the CSF software only alarms me, without doing anything with this processes. Is there any way to make CSF stop/kill such processes ?

Thank you!

Re: Handling with Excessive and Suspicious processes

Posted: 15 Aug 2017, 15:17
by Havri
Hello,

Please look at the PT_USERKILL entry in /etc/csf/csf.conf, although you should first read all the documentation about this feature, as it will kill all the processes that reach the thresholds of PT_USERMEM, PT_USERTIME or PT_USERPROC. Not setting this correctly could of course result in stability issues.

Regards.