Page 1 of 1

Excessive resource usage wheel user

Posted: 22 Apr 2014, 20:35
by tuibm
Hello, im receiving this alerts and i want to know if there is a way to avoid them,

I have a vps , i do not allow ssh root login on this server, so i use a wheel user instead,

Everytime i login with my wheel user, few minutes after login I start receiving a lot of these notifications depending on the time im logged in.
--------------------------
lfd on hostname: Excessive resource usage: mywheeluser (XXXXX (Parent PID:XXXXX))
Time: Time
Account: mywheeluser
Resource: Process Time
Exceeded: 8162 > 1800 (seconds)
Executable: /bin/bash
Command Line: -bash
PID: XXXXXX (Parent PID:XXXXXX)
Killed: No
--------------------------

I already add my user UID and ID on csf.uidignore without luck

Is there any way to avoid this mails alerts?

Thanks

Re: Excessive resource usage wheel user

Posted: 24 Apr 2014, 00:25
by Sergio
try adding to csf.pignore the following line:
user:mywheeluser

Re: Excessive resource usage wheel user

Posted: 26 Apr 2014, 06:29
by htb
I get that same time to much email that i like to disable the alert

Re: Excessive resource usage wheel user

Posted: 26 Apr 2014, 06:36
by Sergio
Rare, as any rule that you write on csf.pignore, csf will not send any emails at all.
So, if you add user:mywheeluser to csf.pignore, that user will never generate any LFD email because of the processes it does.

Re: Excessive resource usage wheel user

Posted: 30 Jun 2015, 09:24
by mrlawrencelam
tuibm wrote: Account: mywheeluser
Resource: Process Time
Exceeded: 8162 > 1800 (seconds)
Executable: /bin/bash
It means that you have SSH to your server and after you have done with your work, you closed the SSH client window instead of disconnecting properly. This caused the process to continue running in the server over a long period of time. So next time disconnect instead of just closing the window.

Re: Excessive resource usage wheel user

Posted: 30 Jun 2015, 09:56
by mrlawrencelam
Look for the PID number and go to WHM >> Process Manager to kill it (for cPanel users).