Resolved PLESK slow, plesk-task-mana always has 25% + CPU usage

[pwouda]

Server operating system version

CentOS Linux 7.9.2009 (Core)

Plesk version and microupdate number

18.0.68 Update #2 Web Host Edition

Hi there,

Since a week or two my PLESK environment is very slow. Every page (even the login-screen) takes about 30 seconds to load.
The 80+ websites on the server however are fast.
In the Process-list the plesk-task-mana always uses 25+% of cpu-usage. Is this normal?

 

[Sebahat.hadzhi]

Hello, @pwouda . Could you please try executing the following command:

ls -laht /var/lib/plesk/task-manager/runtime/ | wc -l

and let us know what's the count.

 

[pwouda]

Hello, @pwouda . Could you please try executing the following command:



and let us know what's the count.

The output is
777556

 

[Sebahat.hadzhi]

Thank you. I suspect that your server might be under brute-force attack. Please also run:

cat /var/log/secure | grep sshd | grep authentication | grep root | wc -l
plesk bin action-log --show | grep 'Login Attempt Failed' | wc -l

If they also return significant numbers, my guess will be right. If that's the case, what I can recommend is to:

1. If not you haven't already, please consider enabling Fail2Ban (with high ban time configured)
2. Change the default SSH port
3. Disable root user login for SSH by adding/editing the following line in /etc/ssh/sshd_config:
   

   PermitRootLogin no

I hope that helps.

 

[pwouda]

I have no SSH-access to my dedicated server, but my hostingprovider has noticed that since march 15 the number of 'Login Attempt Failed'-items have increased a lot.
They advised me to restrict the access to PLESK by setting restrictions to the IP-addresses I use.
Only my hostingprovider has access to SSH, so the say that changing the port will have no effect
They will enable Fail2Ban for me to automaticaly ban IP-adresses.
Is it also possible that PLESK bans certain IP-addresses that are globally on a black-list of offenders?

And another question: after taking these actions, PLESK runs normal again, but the plesk-task-mana process is always around 26% CPU-time. Is this a normal value?

Regards, Peter

 

[Sebahat.hadzhi]

Hello, Peter. If you have Plesk Firewall enabled on the server you should be able to import any desired blacklist without an issue. As for the CPU consumption, that's subjective. I would ask the host to monitor the consumption and ensure the attack is mitigated. You may also ask them to apply the workaround from this thread.

 

[pwouda]

Thanks for you help, Sebahat. My host has taken some action thanks to your advise, and now PLESK is working smooth again. the plesk-task-mana process is not in the top 10 list of CPU-usage.