Question lfd .. Excessive resource usage - Plesk not accessible

[KiamOe]

I have a plesk server ‪CentOS Linux 7.5 Plesk Onyx 17.8.11. a period of about 10 hours I got these errors by mail:

lfd on domain.com: Excessive resource usage:

I get these errors related to various webspaces

The process in question is php-fpm: master process

Resource: Virtual Memory Size
Exceeded: 577 > 512 (MB)
Executable: /opt/plesk/php/7.2/sbin/php-fpm

I have stopped and started the apache service, but no change.
I have stopped and started the plesk service, but no change.
I have stopped and started fail2ban, and no change.

There are some other possibly alarming issues:
I get: "Suspicious process running under user".... postfix/popuser and a few as nginx

Not sure what to do here... restart the server and see of plesk comes back up? Any ideas?

 

[IgorG]

Actually, these messages are not from Plesk. This is from LFD/CSF - a 3rd party firewall that is not a part of Plesk installation.
The reason for such messages is that execution time alarm level "PT_USERTIME = "1800" in /etc/csf/csf.conf was exceeded by apache or other services.

In order to exclude apache from notifications you can try to perform the following steps:

1. Add the row "exe:/usr/sbin/httpd" to file /etc/csf/csf.pignore
2. Restarted csf and lfd:

# csf -r
# service lfd restart

 

[KiamOe]

Thanks IgorG! I'll give this a try... but since these errors appeared.. I can't login to plesk either, what could that be? What error log fil to look for this plesk issue?

 

[IgorG]

I can't login to plesk either,

What sort of errors do you have or how you can't login? More detail, please.

 

[KiamOe]

I get no error at all. Connection timed out...
I tried to disable the firewall "systemctl disable firewalld" but it did not change anything.

What's the most relevant log file to look at?

 

[IgorG]

Check that sw-cp-server service is up and running and that port 8443 is open.

 

[KiamOe]

It's running and port is open...

---
sw-cp-server.service - Startup script for Plesk control panel server
Loaded: loaded (/usr/lib/systemd/system/sw-cp-server.service; enabled; vendor preset: disabled)
Active: active (running) since Thu 2018-08-09 13:37:20 CEST; 39min ago
Main PID: 1096 (sw-cp-serverd)
CGroup: /system.slice/sw-cp-server.service
ââ1096 sw-cp-server: master process /usr/sbin/sw-cp-serverd -c /et...
ââ1100 sw-cp-server: worker process
---

8443/tcp open https-alt