A.Chakery Posted September 24, 2012 Share Posted September 24, 2012 Hello, I am getting this error via my email related to WHMCS's cron job : any help is really appreciated thanks Subj : Excessive resource usage: USER (21996) Time: Mon Sep 24 08:01:38 2012 +0200 Account: faserverz Resource: Process Time Exceeded: 115296 > 1800 (seconds) Executable: /usr/sbin/crond Command Line: crond PID: 21996 Killed: No 0 Quote Link to comment Share on other sites More sharing options...
onliner Posted October 18, 2012 Share Posted October 18, 2012 Hello, I am getting this error via my email related to WHMCS's cron job : any help is really appreciated thanks Subj : Excessive resource usage: USER (21996) Time: Mon Sep 24 08:01:38 2012 +0200 Account: faserverz Resource: Process Time Exceeded: 115296 > 1800 (seconds) Executable: /usr/sbin/crond Command Line: crond PID: 21996 Killed: No Did you manage to solve this error? I'm also getting hundreds of such every day, and they are all related to WHMCS directories. I'm waiting on WHMCS to check this but It has been silent from their side. Please share you solution, if any... Cheers. 0 Quote Link to comment Share on other sites More sharing options...
onliner Posted October 18, 2012 Share Posted October 18, 2012 (edited) For example: lfd on my.server: Suspicious process running under user my.user Executable: /usr/bin/php Command Line (often faked in exploits): /usr/bin/php /home/my.user/public_html/whmcs/domainchecker.php Network connections by the process (if any): tcp: 50.28.60.38:42488 -> 199.7.58.74:43 Files open by the process (if any): (deleted)/tmp/sess_e8aa9234e563eb3a0c89ad121ef7b2df Memory maps by the process (if any): 00400000-00b7e000 r-xp 00000000 fc:03 154485 /usr/bin/php 00d7d000-00e02000 rw-p 0077d000 fc:03 154485 /usr/bin/php 00e02000-00e24000 rw-p 00000000 00:00 0 02770000-03297000 rw-p 00000000 00:00 0 [heap] 3323c00000-3323d38000 r-xp 00000000 fc:03 26194 /usr/lib64/mysql/libmysqlclient.so.15.0.0 3323d38000-3323f37000 ---p 00138000 fc:03 26194 /usr/lib64/mysql/libmysqlclient.so.15.0.0 3323f37000-3323f6b000 rw-p 00137000 fc:03 26194 /usr/lib64/mysql/libmysqlclient.so.15.0.0 3323f6b000-3323f6c000 rw-p 00000000 00:00 0 37e8600000-37e8661000 r-xp 00000000 fc:03 4283139 /usr/lib64/libtiff.so.3.9.4 37e8661000-37e8861000 ---p 00061000 fc:03 4283139 /usr/lib64/libtiff.so.3.9.4 37e8861000-37e8864000 rw-p 00061000 fc:03 4283139 /usr/lib64/libtiff.so.3.9.4 3bb2a00000-3bb2a20000 r-xp 00000000 fc:03 178494 /lib64/ld-2.12.so 3bb2c1f000-3bb2c20000 r--p 0001f000 fc:03 178494 /lib64/ld-2.12.so 3bb2c20000-3bb2c21000 rw-p 00020000 fc:03 178494 /lib64/ld-2.12.so 3bb2c21000-3bb2c22000 rw-p 00000000 00:00 0 3bb2e00000-3bb2f89000 r-xp 00000000 fc:03 178513 /lib64/libc-2.12.so 3bb2f89000-3bb3189000 ---p 00189000 fc:03 178513 /lib64/libc-2.12.so 3bb3189000-3bb318d000 r--p 00189000 fc:03 178513 /lib64/libc-2.12.so 3bb318d000-3bb318e000 rw-p 0018d000 fc:03 178513 /lib64/libc-2.12.so 3bb318e000-3bb3193000 rw-p 00000000 00:00 0 3bb3200000-3bb3283000 r-xp 00000000 fc:03 178630 /lib64/libm-2.12.so 3bb3283000-3bb3482000 ---p 00083000 fc:03 178630 /lib64/libm-2.12.so 3bb3482000-3bb3483000 r--p 00082000 fc:03 178630 /lib64/libm-2.12.so 3bb3483000-3bb3484000 rw-p 00083000 fc:03 178630 /lib64/libm-2.12.so 3bb3600000-3bb3602000 r-xp 00000000 fc:03 178657 /lib64/libdl-2.12.so 3bb3602000-3bb3802000 ---p 00002000 fc:03 178657 /lib64/libdl-2.12.so 3bb3802000-3bb3803000 r--p 00002000 fc:03 178657 /lib64/libdl-2.12.so 3bb3803000-3bb3804000 rw-p 00003000 fc:03 178657 /lib64/libdl-2.12.so 3bb3a00000-3bb3a17000 r-xp 00000000 fc:03 178565 /lib64/libpthread-2.12.so 3bb3a17000-3bb3c17000 ---p 00017000 fc:03 178565 /lib64/libpthread-2.12.so 3bb3c17000-3bb3c18000 r--p 00017000 fc:03 178565 /lib64/libpthread-2.12.so 3bb3c18000-3bb3c19000 rw-p 00018000 fc:03 178565 /lib64/libpthread-2.12.so 3bb3c19000-3bb3c1d000 rw-p 00000000 00:00 0 3bb3e00000-3bb3e15000 r-xp 00000000 fc:03 178674 /lib64/libz.so.1.2.3 3bb3e15000-3bb4014000 ---p 00015000 fc:03 178674 /lib64/libz.so.1.2.3 3bb4014000-3bb4015000 r--p 00014000 fc:03 178674 /lib64/libz.so.1.2.3 3bb4015000-3bb4016000 rw-p 00015000 fc:03 178674 /lib64/libz.so.1.2.3 3bb4200000-3bb4207000 r-xp 00000000 fc:03 178670 /lib64/librt-2.12.so 3bb4207000-3bb4406000 ---p 00007000 fc:03 178670 /lib64/librt-2.12.so 3bb4406000-3bb4407000 r--p 00006000 fc:03 178670 /lib64/librt-2.12.so 3bb4407000-3bb4408000 rw-p 00007000 fc:03 178670 /lib64/librt-2.12.so 3bb4600000-3bb461d000 r-xp 00000000 fc:03 178529 /lib64/libselinux.so.1 3bb461d000-3bb481c000 ---p 0001d000 fc:03 178529 /lib64/libselinux.so.1 3bb481c000-3bb481d000 r--p 0001c000 fc:03 178529 /lib64/libselinux.so.1 3bb481d000-3bb481e000 rw-p 0001d000 fc:03 178529 /lib64/libselinux.so.1 3bb481e000-3bb481f000 rw-p 00000000 00:00 0 3bb4a00000-3bb4a16000 r-xp 00000000 fc:03 178546 /lib64/libresolv-2.12.so 3bb4a16000-3bb4c16000 ---p 00016000 fc:03 178546 /lib64/libresolv-2.12.so 3bb4c16000-3bb4c17000 r--p 00016000 fc:03 178546 /lib64/libresolv-2.12.so 3bb4c17000-3bb4c18000 rw-p 00017000 fc:03 178546 /lib64/libresolv-2.12.so 3bb4c18000-3bb4c1a000 rw-p 00000000 00:00 0 3bb5200000-3bb5207000 r-xp 00000000 fc:03 178683 /lib64/libcrypt-2.12.so 3bb5207000-3bb5407000 ---p 00007000 fc:03 178683 /lib64/libcrypt-2.12.so 3bb5407000-3bb5408000 r--p 00007000 fc:03 178683 /lib64/libcrypt-2.12.so 3bb5408000-3bb5409000 rw-p 00008000 fc:03 178683 /lib64/libcrypt-2.12.so 3bb5409000-3bb5437000 rw-p 00000000 00:00 0 3bb5600000-3bb565d000 r-xp 00000000 fc:03 178681 /lib64/libfreebl3.so 3bb565d000-3bb585c000 ---p 0005d000 fc:03 178681 /lib64/libfreebl3.so 3bb585c000-3bb585d000 r--p 0005c000 fc:03 178681 /lib64/libfreebl3.so 3bb585d000-3bb585e000 rw-p 0005d000 fc:03 178681 /lib64/libfreebl3.so 3bb585e000-3bb5862000 rw-p 00000000 00:00 0 3bb5a00000-3bb5a03000 r-xp 00000000 fc:03 178706 /lib64/libcom_err.so.2.1 3bb5a03000-3bb5c02000 ---p 00003000 fc:03 178706 /lib64/libcom_err.so.2.1 3bb5c02000-3bb5c03000 r--p 00002000 fc:03 178706 /lib64/libcom_err.so.2.1 3bb5c03000-3bb5c04000 rw-p 00003000 fc:03 178706 /lib64/libcom_err.so.2.1 3bb6200000-3bb620a000 r-xp 00000000 fc:03 178704 /lib64/libkrb5support.so.0.1 3bb620a000-3bb6409000 ---p 0000a000 fc:03 178704 /lib64/libkrb5support.so.0.1 3bb6409000-3bb640a000 r--p 00009000 fc:03 178704 /lib64/libkrb5support.so.0.1 3bb640a000-3bb640b000 rw-p 0000a000 fc:03 178704 /lib64/libkrb5support.so.0.1 3bb6600000-3bb66d4000 r-xp 00000000 fc:03 178708 /lib64/libkrb5.so.3.3 3bb66d4000-3bb68d4000 ---p 000d4000 fc:03 178708 /lib64/libkrb5.so.3.3 3bb68d4000-3bb68dd000 r--p 000d4000 fc:03 178708 /lib64/libkrb5.so.3.3 3bb68dd000-3bb68df000 rw-p 000dd000 fc:03 178708 /lib64/libkrb5.so.3.3 3bb6a00000-3bb6a2a000 r-xp 00000000 fc:03 178705 /lib64/libk5crypto.so.3.1 3bb6a2a000-3bb6c29000 ---p 0002a000 fc:03 178705 /lib64/libk5crypto.so.3.1 3bb6c29000-3bb6c2b000 r--p 00029000 fc:03 178705 /lib64/libk5crypto.so.3.1 3bb6c2b000-3bb6c2c000 rw-p 0002b000 fc:03 178705 /lib64/libk5crypto.so.3.1 3bb6e00000-3bb6e02000 r-xp 00000000 fc:03 178703 /lib64/libkeyutils.so.1.3 3bb6e02000-3bb7001000 ---p 00002000 fc:03 178703 /lib64/libkeyutils.so.1.3 3bb7001000-3bb7002000 r--p 00001000 fc:03 178703 /lib64/libkeyutils.so.1.3 3bb7002000-3bb7003000 rw-p 00002000 fc:03 178703 /lib64/libkeyutils.so.1.3 3bb7200000-3bb7216000 r-xp 00000000 fc:03 178672 /lib64/libnsl-2.12.so 3bb7216000-3bb7415000 ---p 00016000 fc:03 178672 /lib64/libnsl-2.12.so 3bb7415000-3bb7416000 r--p 00015000 fc:03 178672 /lib64/libnsl-2.12.so 3bb7416000-3bb7417000 rw-p 00016000 fc:03 178672 /lib64/libnsl-2.12.so 3bb7417000-3bb7419000 rw-p 00000000 00:00 0 3bb7600000-3bb7774000 r-xp 00000000 fc:03 158227 /usr/lib64/libcrypto.so.1.0.0 3bb7774000-3bb7973000 ---p 00174000 fc:03 158227 /usr/lib64/libcrypto.so.1.0.0 3bb7973000-3bb798c000 r--p 00173000 fc:03 158227 /usr/lib64/libcrypto.so.1.0.0 3bb798c000-3bb7996000 rw-p 0018c000 fc:03 158227 /usr/lib64/libcrypto.so.1.0.0 3bb7996000-3bb799a000 rw-p 00000000 00:00 0 3bb7a00000-3bb7a3f000 r-xp 00000000 fc:03 178709 /lib64/libgssapi_krb5.so.2.2 3bb7a3f000-3bb7c3f000 ---p 0003f000 fc:03 178709 /lib64/libgssapi_krb5.so.2.2 3bb7c3f000-3bb7c40000 r--p 0003f000 fc:03 178709 /lib64/libgssapi_krb5.so.2.2 3bb7c40000-3bb7c42000 rw-p 00040000 fc:03 178709 /lib64/libgssapi_krb5.so.2.2 3bb7e00000-3bb7e98000 r-xp 00000000 fc:03 158171 /usr/lib64/libfreetype.so.6.3.22 3bb7e98000-3bb8097000 ---p 00098000 fc:03 158171 /usr/lib64/libfreetype.so.6.3.22 3bb8097000-3bb809d000 rw-p 00097000 fc:03 158171 /usr/lib64/libfreetype.so.6.3.22 3bb8a00000-3bb8a1b000 r-xp 00000000 fc:03 156362 /usr/lib64/libxcb.so.1.1.0 3bb8a1b000-3bb8c1a000 ---p 0001b000 fc:03 156362 /usr/lib64/libxcb.so.1.1.0 3bb8c1a000-3bb8c1b000 rw-p 0001a000 fc:03 156362 /usr/lib64/libxcb.so.1.1.0 3bb8e00000-3bb8e17000 r-xp 00000000 fc:03 178680 /lib64/libaudit.so.1.0.0 3bb8e17000-3bb9016000 ---p 00017000 fc:03 178680 /lib64/libaudit.so.1.0.0 3bb9016000-3bb9017000 r--p 00016000 fc:03 178680 /lib64/libaudit.so.1.0.0 3bb9017000-3bb901c000 rw-p 00017000 fc:03 178680 /lib64/libaudit.so.1.0.0 3bb9200000-3bb9202000 r-xp 00000000 fc:03 157196 /usr/lib64/libXau.so.6.0.0 3bb9202000-3bb9402000 ---p 00002000 fc:03 157196 /usr/lib64/libXau.so.6.0.0 3bb9402000-3bb9403000 rw-p 00002000 fc:03 157196 /usr/lib64/libXau.so.6.0.0 3bb9600000-3bb9739000 r-xp 00000000 fc:03 156364 /usr/lib64/libX11.so.6.3.0 3bb9739000-3bb9939000 ---p 00139000 fc:03 156364 /usr/lib64/libX11.so.6.3.0 3bb9939000-3bb993f000 rw-p 00139000 fc:03 156364 /usr/lib64/libX11.so.6.3.0 3bba600000-3bba653000 r-xp 00000000 fc:03 158228 /usr/lib64/libssl.so.1.0.0 3bba653000-3bba853000 ---p 00053000 fc:03 158228 /usr/lib64/libssl.so.1.0.0 3bba853000-3bba856000 r--p 00053000 fc:03 158228 /usr/lib64/libssl.so.1.0.0 3bba856000-3bba85b000 rw-p 00056000 fc:03 158228 /usr/lib64/libssl.so.1.0.0 3bbaa00000-3bbaa0c000 r-xp 00000000 fc:03 178684 /lib64/libpam.so.0.82.2 3bbaa0c000-3bbac0c000 ---p 0000c000 fc:03 178684 /lib64/libpam.so.0.82.2 3bbac0c000-3bbac0d000 r--p 0000c000 fc:03 178684 /lib64/libpam.so.0.82.2 3bbac0d000-3bbac0e000 rw-p 0000d000 fc:03 178684 /lib64/libpam.so.0.82.2 3bbb200000-3bbb225000 r-xp 00000000 fc:03 158307 /usr/lib64/libpng12.so.0.49.0 3bbb225000-3bbb425000 ---p 00025000 fc:03 158307 /usr/lib64/libpng12.so.0.49.0 3bbb425000-3bbb426000 rw-p 00025000 fc:03 158307 /usr/lib64/libpng12.so.0.49.0 3bbc200000-3bbc232000 r-xp 00000000 fc:03 178697 /lib64/libidn.so.11.6.1 3bbc232000-3bbc431000 ---p 00032000 fc:03 178697 /lib64/libidn.so.11.6.1 3bbc431000-3bbc432000 rw-p 00031000 fc:03 178697 /lib64/libidn.so.11.6.1 3c1ac00000-3c1ac23000 r-xp 00000000 fc:03 155220 /usr/lib64/libjpeg.so.62.0.0 3c1ac23000-3c1ae23000 ---p 00023000 fc:03 155220 /usr/lib64/libjpeg.so.62.0.0 3c1ae23000-3c1ae24000 rw-p 00023000 fc:03 155220 /usr/lib64/libjpeg.so.62.0.0 3c1b000000-3c1b011000 r-xp 00000000 fc:03 4283159 /usr/lib64/libXpm.so.4.11.0 3c1b011000-3c1b210000 ---p 00011000 fc:03 4283159 /usr/lib64/libXpm.so.4.11.0 3c1b210000-3c1b211000 rw-p 00010000 fc:03 4283159 /usr/lib64/libXpm.so.4.11.0 7f3f1b680000-7f3f1b685000 r-xp 00000000 fc:03 178489 /lib64/libnss_dns-2.12.so 7f3f1b685000-7f3f1b884000 ---p 00005000 fc:03 178489 /lib64/libnss_dns-2.12.so 7f3f1b884000-7f3f1b885000 r--p 00004000 fc:03 178489 /lib64/libnss_dns-2.12.so 7f3f1b885000-7f3f1b886000 rw-p 00005000 fc:03 178489 /lib64/libnss_dns-2.12.so 7f3f1b886000-7f3f1ba09000 rw-p 00000000 00:00 0 7f3f1ba09000-7f3f1ba15000 r-xp 00000000 fc:03 178491 /lib64/libnss_files-2.12.so 7f3f1ba15000-7f3f1bc15000 ---p 0000c000 fc:03 178491 /lib64/libnss_files-2.12.so 7f3f1bc15000-7f3f1bc16000 r--p 0000c000 fc:03 178491 /lib64/libnss_files-2.12.so 7f3f1bc16000-7f3f1bc17000 rw-p 0000d000 fc:03 178491 /lib64/libnss_files-2.12.so 7f3f1bc17000-7f3f1bc6c000 r-xp 00000000 fc:03 975653 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/magickwand.so 7f3f1bc6c000-7f3f1be6c000 ---p 00055000 fc:03 975653 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/magickwand.so 7f3f1be6c000-7f3f1be71000 rw-p 00055000 fc:03 975653 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/magickwand.so 7f3f1be71000-7f3f1be7a000 r-xp 00000000 fc:03 157352 /usr/lib64/libltdl.so.7.2.1 7f3f1be7a000-7f3f1c079000 ---p 00009000 fc:03 157352 /usr/lib64/libltdl.so.7.2.1 7f3f1c079000-7f3f1c07a000 rw-p 00008000 fc:03 157352 /usr/lib64/libltdl.so.7.2.1 7f3f1c07a000-7f3f1c087000 r-xp 00000000 fc:03 158758 /usr/lib64/libgomp.so.1.0.0 7f3f1c087000-7f3f1c286000 ---p 0000d000 fc:03 158758 /usr/lib64/libgomp.so.1.0.0 7f3f1c286000-7f3f1c287000 rw-p 0000c000 fc:03 158758 /usr/lib64/libgomp.so.1.0.0 7f3f1c287000-7f3f1c297000 r-xp 00000000 fc:03 178562 /lib64/libbz2.so.1.0.4 7f3f1c297000-7f3f1c496000 ---p 00010000 fc:03 178562 /lib64/libbz2.so.1.0.4 7f3f1c496000-7f3f1c498000 rw-p 0000f000 fc:03 178562 /lib64/libbz2.so.1.0.4 7f3f1c498000-7f3f1c767000 r-xp 00000000 fc:03 159028 /usr/local/lib/libMagickCore.so.4.0.1 7f3f1c767000-7f3f1c966000 ---p 002cf000 fc:03 159028 /usr/local/lib/libMagickCore.so.4.0.1 7f3f1c966000-7f3f1ca0c000 rw-p 002ce000 fc:03 159028 /usr/local/lib/libMagickCore.so.4.0.1 7f3f1ca0c000-7f3f1ca0e000 rw-p 00000000 00:00 0 7f3f1ca0e000-7f3f1caf9000 r-xp 00000000 fc:03 159039 /usr/local/lib/libMagickWand.so.4.0.1 7f3f1caf9000-7f3f1ccf9000 ---p 000eb000 fc:03 159039 /usr/local/lib/libMagickWand.so.4.0.1 7f3f1ccf9000-7f3f1ccfd000 rw-p 000eb000 fc:03 159039 /usr/local/lib/libMagickWand.so.4.0.1 7f3f1ccfd000-7f3f1cd54000 r-xp 00000000 fc:03 975652 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/imagick.so 7f3f1cd54000-7f3f1cf53000 ---p 00057000 fc:03 975652 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/imagick.so 7f3f1cf53000-7f3f1cf64000 rw-p 00056000 fc:03 975652 /usr/local/lib/php/extensions/no-debug-non-zts-20090626/imagick.so 7f3f1cf64000-7f3f1d04d000 r-xp 00000000 fc:03 292058 /usr/local/IonCube/ioncube_loader_lin_5.3.so 7f3f1d04d000-7f3f1d14c000 ---p 000e9000 fc:03 292058 /usr/local/IonCube/ioncube_loader_lin_5.3.so 7f3f1d14c000-7f3f1d15c000 rw-p 000e8000 fc:03 292058 /usr/local/IonCube/ioncube_loader_lin_5.3.so 7f3f1d15c000-7f3f1d1ae000 rw-p 00000000 00:00 0 7f3f1d1ef000-7f3f1d1f7000 rw-p 00000000 00:00 0 7f3f1d1f7000-7f3f1d33d000 r-xp 00000000 fc:03 17720 /opt/xml2/lib/libxml2.so.2.7.8 7f3f1d33d000-7f3f1d53c000 ---p 00146000 fc:03 17720 /opt/xml2/lib/libxml2.so.2.7.8 7f3f1d53c000-7f3f1d546000 rw-p 00145000 fc:03 17720 /opt/xml2/lib/libxml2.so.2.7.8 7f3f1d546000-7f3f1d548000 rw-p 00000000 00:00 0 7f3f1d548000-7f3f1d5a0000 r-xp 00000000 fc:03 18583 /opt/curlssl/lib/libcurl.so.4.2.0 7f3f1d5a0000-7f3f1d7a0000 ---p 00058000 fc:03 18583 /opt/curlssl/lib/libcurl.so.4.2.0 7f3f1d7a0000-7f3f1d7a3000 rw-p 00058000 fc:03 18583 /opt/curlssl/lib/libcurl.so.4.2.0 7f3f1d7a3000-7f3f1d7a6000 rw-p 00000000 00:00 0 7f3f1d7a6000-7f3f1d7e2000 r-xp 00000000 fc:03 30143 /opt/pcre/lib/libpcre.so.0.0.1 7f3f1d7e2000-7f3f1d9e1000 ---p 0003c000 fc:03 30143 /opt/pcre/lib/libpcre.so.0.0.1 7f3f1d9e1000-7f3f1d9e2000 rw-p 0003b000 fc:03 30143 /opt/pcre/lib/libpcre.so.0.0.1 7f3f1d9e2000-7f3f1d9e5000 rw-p 00000000 00:00 0 7f3f1d9f3000-7f3f1d9f4000 rw-p 00000000 00:00 0 7fffe45d7000-7fffe45ec000 rw-p 00000000 00:00 0 [stack] 7fffe45fe000-7fffe4600000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] ----------------- than also: ---------------- lfd on my.server: Excessive resource usage: my.user (829065) Time: Thu Oct 18 08:01:02 2012 -0400 Account: my.user Resource: Process Time Exceeded: 247399 > 1800 (seconds) Executable: /usr/bin/php Command Line: /usr/bin/php /home/my.user/public_html/whmcs/domainchecker.php PID: 829065 Killed: No ---------------- I really hope it is NOT a memory leak that can compromise security! Anyone? Edited October 18, 2012 by onliner 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.