Issue GoAccess using significantly more RAM after update to Plesk Obsidian 18.0.79?

[Azurel]

Server operating system version

AlmaLinux 8.10

Plesk version and microupdate number

Plesk Obsidian 18.0.79#2

I'm trying to determine whether this is a bug or just a coincidence after upgrading to Plesk Obsidian 18.0.79. Since the update, I've noticed that the GoAccess report generation suddenly consumes MUCH more memory than before.

Some details:

• AlmaLinux 8.10 with 128 GB RAM
• GoAccess is started by Plesk with --persist --restore --keep-last 90
• Current access log size for ONE domain: ~969 MB
• GoAccess persistence database for ONE domain: ~26 GB
• During report generation, the GoAccess process reaches about 47 GB(!) for ALL domains, before this never happen.

The command being executed is:

# ps aux --sort=-%mem | head -30

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 3260406 99.1 37.6 60169848 49425936 ? Rl 04:00 331:22 goaccess --html-report-title EXAMPLE.com --log-format COMBINED --persist --restore --keep-last 90 --db-path /var/www/vhosts/system/EXAMPLE.com/goaccess/webstat-ssl --output /var/www/vhosts/system/EXAMPLE.com/statistics/webstat-ssl/index.html /var/www/vhosts/system/EXAMPLE.com/logs/access_ssl_log.webstat

I'm wondering whether anything changed in Plesk 18.0.79 regarding GoAccess, for example:

• a cron job no longer running (or not running regularly),
• log rotation changes,
• GoAccess persistence no longer being cleaned up correctly,
• or another known issue that could cause the persistence database to grow unexpectedly.

Has anyone else observed similar behavior after upgrading to 18.0.79? Any ideas on what else I should check would be greatly appreciated.

# htop

 

[Azurel]

I checked my RAM monitoring history and found that the increase did not start with the Plesk update. The memory usage started to increase suddenly on July 8th. Before that date, the server never ever used that much RAM. (02. July was a server restart because almalinux security patches)



Offtopic: Why is here a scrollbar and legend is not visible?

 

[Azurel]

I have now disabled GoAccess for all (2) domains in Plesk. The "goaccess" directories were removed from the server as expected. However, I noticed that the process itself is still running and continues to consume around 50 GB of RAM. Is there a recommended "plesk way" to stop/clean up these remaining GoAccess processes or it safe to simply terminate the process manually with "kill 3260406"?

root 3260406 99.1 37.6 60169848 49425936 ? Rl 04:00 331:22 goaccess --html-report-title EXAMPLE.com --log-format COMBINED --persist --restore --keep-last 90 --db-path /var/www/vhosts/system/EXAMPLE.com/goaccess/webstat-ssl --output /var/www/vhosts/system/EXAMPLE.com/statistics/webstat-ssl/index.html /var/www/vhosts/system/EXAMPLE.com/logs/access_ssl_log.webstat

 

[Sebahat.hadzhi]

Hi, @Azurel . I can't find any recent changes performed concerning GoAccess. Neither can I locate any recent complaints of memory usage spikes specifically related to GoAccess.
Manually killing the remaining tasks shouldn't be an issue.
Have you checked the actual access logs for any traffic spikes? It's worth ruling out a DDoS (or even just heavy bot/scraper traffic).

 

[Azurel]

Thanks. The process has just terminated on its own and the memory has been released again. I checked the Monitoring graphs (CPU, processes, network) for the last 30 days and there are no traffic or resource spikes around that time. The only metric that suddenly changed is the RAM usage, starting on July 8.

I have one possible explanation. My website has a search function and, as far as I understand, GoAccess treats every URL including its query string as a unique request. For example:

• /abc?search=a
• /abc?search=b

would be stored as two different request URLs. Plesk runs GoAccess with "--persist --restore --keep-last 90". This means that unique request URLs are accumulated for up to 90 days and restored again on every run. If there is a sudden increase in requests with many different query strings (from bots, scrapers, or whatever), the persistent database can grow very quickly and require a large amount of memory during the restore phase. These were the 20 largest files in one of the GoAccess database directories for one domain:

# find /var/www/vhosts/system/EXAMPLE.com/goaccess/webstat-ssl -type f -printf "%s %f\n" | sort -nr | head -20
3035125726 IS32_REQUESTS_MTRC_DATAMAP.db
1862146370 IS32_HOSTS_MTRC_DATAMAP.db
1789323032 U648_REQUESTS_MTRC_UNIQMAP.db
1320708298 IU64_REQUESTS_MTRC_CUMTS.db
1320708298 IU64_REQUESTS_MTRC_BW.db
1211096651 IS32_NOT_FOUND_MTRC_DATAMAP.db
981304234 IU64_HOSTS_MTRC_CUMTS.db
981304234 IU64_HOSTS_MTRC_BW.db
896330093 SI32_UNIQUE_KEYS.db
880472446 II32_REQUESTS_MTRC_KEYMAP.db
880472446 II32_REQUESTS_MTRC_HITS.db
879841950 II32_REQUESTS_MTRC_VISITORS.db
765666082 IU64_NOT_FOUND_MTRC_CUMTS.db
765666082 IU64_NOT_FOUND_MTRC_BW.db
717060412 U648_VISIT_TIMES_MTRC_UNIQMAP.db
660354520 II08_REQUESTS_MTRC_PROTOCOLS.db
660354520 II08_REQUESTS_MTRC_METHODS.db
654203070 II32_HOSTS_MTRC_KEYMAP.db
654203070 II32_HOSTS_MTRC_HITS.db
601697672 U648_STATUS_CODES_MTRC_UNIQMAP.db

And would it make sense for Plesk to support GoAccess with the "--no-query-string" option, or at least make it available as an optional setting? If my assumption is correct, that would prevent this kind of database growth for websites where query strings are not relevant for the statistics.

GoAccess Man Page - Full Command Line Reference

-q --no-query-string
Ignore request's query string. e.g., www.google.com/page.htm?query → www.google.com/page.htm. Can greatly decrease memory consumption on timestamped requests.