Resolved lfd on server.xxxx.xx: Excessive processes running under user ngold

[Tize]

Hello everyone, I am in contact to see if they can give me a little light on a problem I have been doing for a few weeks.
I have a Wordpress installation, updated to the latest version.
And I receive daily movement notices with the administrator user that I do not understand why.
I have the latest version of PHP installed for both this domain and the other installations.

I enclose more information in case you could help me please.
Thank you very much, anticipated.

Time:          Mon Jun 10 19:31:45 2019 +0200
Account:       ngold
Process Count: 15 (Not killed)

Process Information:

User:ngold PID:18602 PPID:31614 Run Time:11(secs) Memory:499216(kb) RSS:116852(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18603 PPID:31614 Run Time:11(secs) Memory:490152(kb) RSS:107584(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18604 PPID:31614 Run Time:11(secs) Memory:490152(kb) RSS:107344(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18605 PPID:31614 Run Time:11(secs) Memory:496872(kb) RSS:114256(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18606 PPID:31614 Run Time:11(secs) Memory:496876(kb) RSS:114260(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18607 PPID:31614 Run Time:11(secs) Memory:499500(kb) RSS:118064(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18609 PPID:31614 Run Time:11(secs) Memory:499796(kb) RSS:118368(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18614 PPID:31614 Run Time:10(secs) Memory:499624(kb) RSS:115576(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18620 PPID:31614 Run Time:7(secs) Memory:496472(kb) RSS:112348(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18621 PPID:31614 Run Time:7(secs) Memory:493864(kb) RSS:109832(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18622 PPID:31614 Run Time:6(secs) Memory:491696(kb) RSS:107744(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18623 PPID:31614 Run Time:6(secs) Memory:491536(kb) RSS:107876(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18624 PPID:31614 Run Time:5(secs) Memory:491696(kb) RSS:107744(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18625 PPID:31614 Run Time:5(secs) Memory:489420(kb) RSS:105620(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini
User:ngold PID:18626 PPID:31614 Run Time:5(secs) Memory:489088(kb) RSS:105408(kb) exe:/opt/plesk/php/7.3/bin/php-cgi cmd:/opt/plesk/php/7.3/bin/php-cgi -c /var/www/vhosts/system/MYDOMAIN.COM/etc/php.ini

 

[IgorG]

Do you have Firewall CSF installed on your Plesk server? Looks like that this notification is sent by CSF, right?

 

[Tize]

Do you have Firewall CSF installed on your Plesk server? Looks like that this notification is sent by CSF, right?

Hello good morning @IgorG, thank you very much for your response as always.
Yes, in fact, I have this firewall installed.
But my fear is that those actions are of something that has another more serious intention. That's why I wanted to ask if you can know what it means please.

Thank you.

 

[IgorG]

Since the CSF extension is not developed by Plesk it is better to contact ConfigServer Technical Support. This is not necessarily a bad thing.

Probably the solution is to whitelist the process from the message in /etc/csf/csf.pignore file.

1. Look through the email and find the process that causes this message(for example "mysqld" process).

2. Check the /etc/csf/csf.pignore file with grep command:
# grep -i mysql /etc/csf/csf.pignore
exe:/usr/sbin/mysqld
exe:/usr/sbin/mysqld_safe

Add the corresponding process in case it is absent in /etc/csf/csf.pignore file.

3. If the process is in this file then make sure that path matches where mysql is located on the server, with whereis command:

# whereis mysqld
mysqld: /usr/sbin/mysqld /usr/share/man/man8/mysqld.8.gz

4. Restart CSF with the command below:

# csf -r

5. Restart lfd with the command:

# service lfd restart

 

[Tize]

Since the CSF extension is not developed by Plesk it is better to contact ConfigServer Technical Support. This is not necessarily a bad thing.

Probably the solution is to whitelist the process from the message in /etc/csf/csf.pignore file.

1. Look through the email and find the process that causes this message(for example "mysqld" process).

2. Check the /etc/csf/csf.pignore file with grep command:
# grep -i mysql /etc/csf/csf.pignore
exe:/usr/sbin/mysqld
exe:/usr/sbin/mysqld_safe

Add the corresponding process in case it is absent in /etc/csf/csf.pignore file.

3. If the process is in this file then make sure that path matches where mysql is located on the server, with whereis command:

# whereis mysqld
mysqld: /usr/sbin/mysqld /usr/share/man/man8/mysqld.8.gz

4. Restart CSF with the command below:

# csf -r

5. Restart lfd with the command:

# service lfd restart

Hello good morning @IgorG, I am doing what you have recommended me and indeed.
The process is not in the list.
Now it is.

Thank you very much for your work and dedication, and for the great help you offer to all of us.
Receives a warm greeting.