SOLVED High server load unless lfd is stopped, issue only started the last few days

[David P.]

Within the last few days I have been experiencing a very high server load, to the point where the only way to reboot the server is to hard reset it. Had the hosting provider look at it and they gave me suggestions about disabling wp-cron on sites and scheduling the tasks through the cpanel cron, but the issue still seemed to be occurring.

A little history server is centos 7 latest version of WHM, CSF, imunify360, and wordpress toolkit are some of the things installed for security purposes and everything was fine until I want to say Saturday, where both servers started becoming really unstable. Nothing changed config or hardware wise.

The other day I was getting e-mails that lfd was not running, because csf needed to be restarted to clear an error so I left lfd off and found that the server was stable and the load was within normal changes, so I went into service manager and unchecked lfd from notifying and from running. I did that for both servers and I noticed the servers would be stable up until around 2 am, where I guess something causes lfd to retrigger and eventually the server crashes.

Has anyone experienced this recently? I have posted in the CSF forums as well.

 

[cPRex]

Hey there! I haven't had any similar reports of the LFD service causing this type of issue. I would hope the CSF forums had some ideas or ways you could do some testing with this, as we don't provide support for that tool on our side, but I would be very interested to know what you end up finding out!

 

[David P.]

I think we just figured it out, it turns out something weird maybe going on with our providers monitoring servers that it is spamming ssh every 2-5 seconds eventually causing it to crash. Looked in the LFD log and found nearly 10,000 entries. So I turned off one of the monitoring protocols and it seemed to have cleared.

Hey there! I haven't had any similar reports of the LFD service causing this type of issue. I would hope the CSF forums had some ideas or ways you could do some testing with this, as we don't provide support for that tool on our side, but I would be very interested to know what you end up finding out!

 

[cPRex]

I'm glad you were able to track that one down!

 

[David P.]

Well not exactly, I stepped away briefly and when I checked server load averages were well over 700, so I stop LFD and in the process of stopping it went up to 7000 load average, then quickly leveled off but no new entries in the LFD log.

I'm glad you were able to track that one down!

 

[cPRex]

Did CSF ever reply to you directly?

 

[David P.]

Did CSF ever reply to you directly?

That's a negative, I haven't seen any replies from the CSF forums. Also, they don't provide support on the free scripts only community support, which CSF is a free script.

 

[cPRex]

If you'd like to make a ticket with our team we can take a look at the system just to rule anything out on our end.

 

[David P.]

If you'd like to make a ticket with our team we can take a look at the system just to rule anything out on our end.

I did thank you, Case # 94686092

 

[cPRex]

Thanks for getting that ticket submitted. I do see that our team was able to check the system and didn't find any issues with cPanel itself. It would be best to continue trying to discuss this with CSF directly to see if they have additional details about this behavior.