Issue LFD Alerts generating massive amounts of emails

[SolarStorm]

Server operating system version

Alma Linux 8 - Linux 4.18.0-513.5.1.el8_9.x86_64

Plesk version and microupdate number

Plesk Obsidian Web Pro Edition 18.0.61 Update #5

Hello,

My plesk server has been running for a couple of months without any issue.

The past two weeks LFD has begun flooding my google account with emails, causing Google to stop accepting emails from the server.

While the general resource usage remains the same, I am unable to understand why all of a sudden this started.

While the main number of alerts are around excessive resource usage or suspicious processes for user psaadm (see below samples), they also include other names/accounts such as, sw-cp-server, Grafana, popuser, postfix and more.

Below are some alerts as examples sitting in the mail queue. Most are generated very couple of minutes.

lfd on server.domain.com: Excessive resource usage: grafana (2227135 (Parent PID:2227120))
lfd on server.domain.com: Suspicious process running under user postfix
lfd on server.domain.com: Suspicious process running under user popuser
lfd on server.domain.com: Suspicious process running under user postfix
lfd on server.domain.com: Excessive processes running under user postfix
lfd on server.domain.com: Suspicious process running under user postfix
lfd on server.domain.com: Suspicious process running under user popuser
lfd on server.domain.com: Suspicious process running under user postfix
lfd on server.domain.com: Suspicious process running under user postfix
lfd on server.domain.com: Suspicious process running under user popuser
lfd on server.domain.com: Suspicious process running under user postfix
lfd on server.domain.com: Excessive resource usage: apache (2081195 (Parent PID:27225))
lfd on server.domain.com: Excessive resource usage: apache (2081194 (Parent PID:27225))
lfd on server.domain.com: Excessive resource usage: apache (2081238 (Parent PID:27225))
lfd on server.domain.com: Excessive resource usage: nginx (221127 (Parent PID:221126))
lfd on server.domain.com: Excessive resource usage: postfix (12693 (Parent PID:12693))
lfd on server.domain.com: Excessive resource usage: apache (2081377 (Parent PID:27225))
lfd on server.domain.com: Excessive resource usage: dovecot (9203 (Parent PID:9201))
lfd on server.domain.com: Suspicious process running under user nginx
lfd on server.domain.com: Excessive resource usage: dovecot (26159 (Parent PID:9201))
lfd on server.domain.com: Excessive resource usage: psaadm (809 (Parent PID:809))
lfd on server.domain.com: Excessive resource usage: plesk-ssh-terminal (1139211 (Parent PID:11392
lfd on server.domain.com: Excessive resource usage: psaadm (1420 (Parent PID:1420))
lfd on server.domain.com: Excessive resource usage: apache (2099864 (Parent PID:27225))
lfd on server.domain.com: Excessive resource usage: psaadm (2139794 (Parent PID:2139794))
lfd on server.domain.com: Excessive resource usage: psaadm (2139829 (Parent PID:2139823))
lfd on server.domain.com: Excessive resource usage: psaadm (2139841 (Parent PID:2139829))
lfd on server.domain.com: Excessive resource usage: psaadm (2139842 (Parent PID:2139841))
lfd on server.domain.com: Excessive resource usage: psaadm (2139796 (Parent PID:2139794))
lfd on server.domain.com: Excessive resource usage: apache (2081294 (Parent PID:27225))
lfd on server.domain.com: Excessive resource usage: apache (2128137 (Parent PID:27225))
lfd on server.domain.com: Excessive resource usage: apache (2128402 (Parent PID:27225))
lfd on server.domain.com: Excessive resource usage: apache (2128070 (Parent PID:27225))
lfd on server.domain.com: Excessive resource usage: apache (2127932 (Parent PID:27225))
lfd on server.domain.com: Excessive resource usage: apache (2128003 (Parent PID:27225))
lfd on server.domain.com: Excessive resource usage: apache (2128204 (Parent PID:27225))
lfd on server.domain.com: Suspicious process running under user postfix
lfd on server.domain.com: Suspicious process running under user postfix
lfd on server.domain.com: Suspicious process running under user popuser
lfd on server.domain.com: Excessive resource usage: grafana (2227120 (Parent PID:2227120))
lfd on server.domain.com: Excessive resource usage: sw-cp-server (2226609 (Parent PID:220765))
lfd on server.domain.com: Suspicious process running under user grafana
lfd on server.domain.com: Excessive resource usage: grafana (2227135 (Parent PID:2227120))
lfd on server.domain.com: Suspicious process running under user sw-cp-server
lfd on server.domain.com: Suspicious process running under user postfix
lfd on server.domain.com: Suspicious process running under user popuser
lfd on server.domain.com: Suspicious process running under user postfix

If I can get some help or advise on what I can do to find the root cause, it would be much appreciated.