Hello,
I regularly get warnings (via CPFence) that there is excessive CPU usage on my control panel server. I get around five such reports every day.
There are no public sites hosted on that server. There is a site I use for hosting MainWP which I use for managing remote WP sites.
The culprit in all the warning reports I've looked as is always the find process.
The most consistent and significant CPU consumer that isn't a temporary monitoring command is the /usr/bin/find /dev /tmp /li process. This process is actively searching through directories like /dev, /tmp, and what appears to be /lib or a similar path (/li is truncated).
Why is Enhance running an intensive find operation four or five times a day? What's it doing and is this necessary?
Here is the typical load each time I get this report:
cPFence has detected that the CPU load average (26.17) is above your current email alert threshold 2.4.
The load has been consistently high for over 300 seconds.
More system info:
CPU MEM I/O HDD Inode Load Avg
100% 48% 2.00% 68% 71% 26.17
Current Processes output:
USER ELAPSED %CPU %MEM CMD PID
root 00:00 100 0.1 ps -eo user,etime,%cpu,%mem 3232508
root 08:26:45 69.0 0.5 /usr/bin/find /dev /tmp /li 3031131
vector 00:00 37.5 0.9 /usr/bin/vector validate 3232450
root 50-04:18:08 2.8 0.0 [kswapd0] 58
root 01:35 2.8 0.6 /usr/lib/snapd/snapd 3229639
root 50-04:18:09 1.8 4.1 /usr/lib/systemd/systemd -- 1
postfix 37:01 1.0 0.1 postlogd -l -n postlog -t u 3229314
root 25:14 0.9 0.0 [kworker/2:1-events] 3229460
polkitd 03:05:37 0.8 0.1 /usr/lib/polkit-1/polkitd - 3165386
systemd+ 03:05:37 0.8 0.1 /usr/lib/systemd/systemd-re 3165387
systemd+ 03:05:37 0.7 0.1 /usr/lib/systemd/systemd-ti 3165388
systemd+ 03:05:28 0.7 0.1 /usr/lib/systemd/systemd-ne 3165592
root 08:47 0.7 0.0 [kworker/0:0-rcu_gp] 3229550
root 20:03 0.5 0.0 [kworker/1:0-cgroup_destroy 3229490
root 24:13 0.5 0.0 [kworker/0:2-events] 3229466
root 03:05:37 0.4 0.1 /usr/lib/systemd/systemd-ud 3165408
cp_insp+ 05:52:33 0.4 0.3 php-fpm: master process (/u 3080123
syslog 03:05:37 0.4 0.1 /usr/sbin/rsyslogd -n -iNON 3165382
root 33:04 0.4 0.0 [kworker/u6:0-events_power_ 3229392
root 12:41 0.4 0.0 [kworker/1:2-events] 3229529
Here is a more detailed view of the findprocess:
/usr/bin/find /dev /tmp /lib /etc /var ( -name tcp.log -o -name .linux-sniff -o -name sniff-10g -o -name core_
As far as I can tell, find is constantly consuming the most CPU. At least, any time I check the process list.
The parent is: /usr/bin/find /dev /tmp /lib /etc /var ( -name tcp.log -o -name .linux-sniff -o -name sniff-l0g -o -name core_ ) which suggests to me this is CPFence causing this issue. I will take it up with them.
