• Please be aware: Kaspersky Anti-Virus has been deprecated
    With the upgrade to Plesk Obsidian 18.0.64, "Kaspersky Anti-Virus for Servers" will be automatically removed from the servers it is installed on. We recommend that you migrate to Sophos Anti-Virus for Servers.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

Issue aum (ModSecurity) thread perpetuating leading to high cpu usage

robskinn

New Pleskian
Hi,
On my Plesk Linux server, a process called aum is running at timed intervals and doesn't remove itself. I noticed this when my server had severely slowed down (5000% + CPU usage) to an almost unusable state. After looking into it, I found a few mentions for ModSecurity and AUM, so I disabled the Mod and killed the processors. I'd like to get to the root of the problem. Any ideas?

These are the aum processors.
29244 root 20 0 11048 4 0 R 46.5 0.0 159:20.56 aum
2632 root 20 0 11048 4 0 R 45.2 0.0 113:30.83 aum
6137 root 20 0 11048 4 0 R 45.2 0.0 80:02.61 aum
20380 root 20 0 11048 4 0 R 45.2 0.0 288:27.29 aum
22714 root 20 0 11048 4 0 R 43.9 0.0 229:13.82 aum
12679 root 20 0 11048 4 0 R 43.2 0.0 17:13.44 aum
17793 root 20 0 11048 4 0 R 43.2 0.0 348:26.35 aum
12302 root 20 0 11048 4 0 R 41.2 0.0 407:48.22 aum
8742 root 20 0 11048 4 0 R 39.9 0.0 46:30.90 aum
 
Last edited:
Further to this post, I think the issue may be the KernelCare Extension on Plesk. The extension can't communicate with the CloudLinux on my server. I ran ssh compatibility checks as recommended on their website and all was OK (COMPATIBLE), but the actual KernelCare settings fail to load in Plesk. Removed the app and new four-hour aum process was removed. Hope this helps anyone with the same issue.
I'd still like to know why the communication from my server to KernelCare CloudLinux was blocked, if anyone has had a similar issue with it please let me know.
 
Back
Top