Find the answer to your Linux question:
Page 1 of 2 1 2 LastLast
Results 1 to 10 of 17
Hello you reading this, First of all thank you for your time helping me out. Also I'm not sure if this is the correct category to post it since mayby ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined! Senethic's Avatar
    Join Date
    Oct 2012
    Location
    Netherlands
    Posts
    24

    Cron Daemon: opt/plesk-billing/task-manager/scripts/run-all.sh problem


    Hello you reading this,

    First of all thank you for your time helping me out.
    Also I'm not sure if this is the correct category to post it since mayby its more related to Plesk then CentOS.

    Anyway 2 days ago my plesk panel broke and I tried to repair it thru SSH. Somehow it keeps doing cron jobs which keep 'breaking' somehow.
    Now at a certain time I keep getting emails from myself with the swap memory at 100%.

    Also I keep receiving them each 5 minutes.

    IMAGE: puu.sh/1J6D3

    This is the email I'm getting

    Subject:

    Name:
    Code:
    Cron Daemon
    Code:
    Cron <psaadm domain> opt/plesk-billing/task-manager/scripts/run-all.sh --config /opt/plesk-billing/task-manager/config/config.ini
    Message:

    Code:
    /opt/plesk-billing/task-manager/scripts/run-all.sh: fork: retry: Resource temporarily unavailable
    /opt/plesk-billing/task-manager/scripts/run-all.sh: fork: retry: Resource temporarily unavailable
    /opt/plesk-billing/task-manager/scripts/run-all.sh: fork: retry: Resource temporarily unavailable
    /opt/plesk-billing/task-manager/scripts/run-all.sh: fork: retry: Resource temporarily unavailable
    /opt/plesk-billing/task-manager/scripts/run-all.sh: fork: Resource temporarily unavailable
    The email after that:

    Code:
    execl: couldn't exec `/bin/sh'
    execl: Resource temporarily unavailable


    Thank you for your time.

    Kind regards,

    Senethic




    EDIT:

    I saw that I had 3 interfaces running.
    I deleted eth:01 and eth:02


    Not sure if this was a problem or not but it surely didn't help by having multiple interfaces.
    Last edited by Senethic; 01-03-2013 at 09:21 PM.

  2. #2
    Trusted Penguin
    Join Date
    May 2011
    Posts
    4,353
    It sounds like you have runaway processes that are eating up RAM. If you can ssh in, run a ps command and show the output, e.g.:

    Code:
    ps auxww
    see if there are such processes. you can find the PID of these processes in the output, and use kill -9 PID to kill the processes, if you wish/desire. It would be best to determine what is causing them to run in the first place, though (assuming they are rogue processes, that is - otherwise, you just need to address your hardware specs or run less processes).

    You can also try top, which is better at showing mem usage, and sort on the MEM column (should be the tenth one), e.g.:
    Code:
     top -c -b -n 1|awk '$1 ~ /^[0-9]*$/ && $10 ~ /^[0-9\.]*$/'|sort -rk10
    Edit: Not sure why having aliased ethernet interfaces would cause processes to eat up RAM. They alone are just virtual network interfaces that provided additional network addressing for the machine.
    Last edited by atreyu; 01-04-2013 at 05:34 AM. Reason: see edit

  3. #3
    Just Joined! Senethic's Avatar
    Join Date
    Oct 2012
    Location
    Netherlands
    Posts
    24
    ps auxw gives me a huge list with the following stuff


    Code:
    psaadm   32609  0.0  0.0 257396  4772 ?        S    05:40   0:00 /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto
    Last edited by atreyu; 01-05-2013 at 02:25 AM. Reason: edited to remove inadvertent spaces

  4. $spacer_open
    $spacer_close
  5. #4
    Trusted Penguin
    Join Date
    May 2011
    Posts
    4,353
    Quote Originally Posted by Senethic View Post
    ps auxw gives me a huge list with the following stuff
    You've only included one line of ps output. Do you mean to say that the same process (/usr/bin/sw-engine-cgi ...), but with different PIDS (in column 2) is repeated? I would guess that it is a CGI page that is trying to be called, or some other web/php-type process. Do you know why that might be? Can you restart the webserver?

  6. #5
    Just Joined! Senethic's Avatar
    Join Date
    Oct 2012
    Location
    Netherlands
    Posts
    24
    Quote Originally Posted by atreyu View Post
    You've only included one line of ps output. Do you mean to say that the same process (/usr/bin/sw-engine-cgi ...), but with different PIDS (in column 2) is repeated? I would guess that it is a CGI page that is trying to be called, or some other web/php-type process. Do you know why that might be? Can you restart the webserver?
    I actually restarted the server a couple of times. The weird thing is that the 'mailing' keeps happening at 17:00 aka 5 PM.
    So my guess is that there is some kind of thing that keeps calling up the cron job at 5 Pm.

    I've looked up on the cron tabs but found nothing yet.

    Any other suggestions?

  7. #6
    Trusted Penguin
    Join Date
    May 2011
    Posts
    4,353
    Quote Originally Posted by Senethic View Post
    So my guess is that there is some kind of thing that keeps calling up the cron job at 5 Pm.
    Or something external (and sinister) is accessing that webpage or whatever at that time.

    I've looked up on the cron tabs but found nothing yet.
    Have you look in *all* the system cron files? The most likely one would be one in the dir /etc/cron.daily/ but check all the files returned by this command:
    Code:
    find /etc/cron* -type f
    also, as root, check the files in this dir (they're plain text):
    Code:
    /var/spool/cron/
    Have you deteremined what that command is actually doing, btw?

    Code:
    /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto
    Perhaps you are being *probed*, check out this article. Check the plesk logs and your system logs (/var/log/messages and /var/log/secure).
    Last edited by atreyu; 01-05-2013 at 03:08 PM. Reason: removed accidentally quoted text

  8. #7
    Just Joined! Senethic's Avatar
    Join Date
    Oct 2012
    Location
    Netherlands
    Posts
    24
    Quote Originally Posted by atreyu View Post
    Or something external (and sinister) is accessing that webpage or whatever at that time.


    Have you look in *all* the system cron files? The most likely one would be one in the dir /etc/cron.daily/ but check all the files returned by this command:
    Code:
    find /etc/cron* -type f
    also, as root, check the files in this dir (they're plain text):
    Code:
    /var/spool/cron/
    Have you deteremined what that command is actually doing, btw?

    Code:
    /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto
    Perhaps you are being *probed*, check out "kb.parallels. com/en/8119" article. Check the plesk logs and your system logs (/var/log/messages and /var/log/secure).
    Hey,


    /var/spool/cron/ root gives me

    47 23 * * * /usr/sbin/ntpdate -b -s ntp.ovh.net

    No other information is given nor files.


    Also my SSH is closed for everybody else. I IPtabled everyone out except my own IP.


    Thanks for the help so far.
    Last edited by atreyu; 01-05-2013 at 03:09 PM. Reason: removed accidentally quoted text

  9. #8
    Trusted Penguin
    Join Date
    May 2011
    Posts
    4,353
    Quote Originally Posted by Senethic View Post
    Also my SSH is closed for everybody else. I IPtabled everyone out except my own IP.
    I don't think it is SSH-based, but rather HTTP-based. But that depends on how that cgi command is invoked, of course. It is good that you are using iptables, but are you limiting it to ssh (port 22, etc.) connections or all ports (which would cover http/80)?

  10. #9
    Just Joined! Senethic's Avatar
    Join Date
    Oct 2012
    Location
    Netherlands
    Posts
    24
    Quote Originally Posted by atreyu View Post
    I don't think it is SSH-based, but rather HTTP-based. But that depends on how that cgi command is invoked, of course. It is good that you are using iptables, but are you limiting it to ssh (port 22, etc.) connections or all ports (which would cover http/80)?
    Port 80 is open for all, only 22 is open for me.

  11. #10
    Trusted Penguin
    Join Date
    May 2011
    Posts
    4,353
    Quote Originally Posted by Senethic View Post
    Port 80 is open for all, only 22 is open for me.
    Which makes sense if you want/need others (i.e., the rest of the world) to access a webserver (or plesk) on your system. Is that the case? If not, then limit port 80 to only your ip address as well, via iptables. Even if you do want to leave port 80 open, maybe block it temporarily and see if the problem goes away.

    Also, did you check the log files to look for malicious/suspicious behavior? You might want to consider Fail2ban, too.

Page 1 of 2 1 2 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •