Resolved FTP_user consumes 25% of Ram

[Meczup zade]

Hello,

I've been using Plesk for 2+ years but there are something that I can not even understand. This problem is one of that.

In the image (attached), as you see, "ftp user" consumes 25% of ram. It does not do that everytime. But when I get alert level changed from Server Health Monitor, I open the VPS and use the command "top". And these are the results.

What is the problem with that? I do not even use ftp while I'm getting this alert level change error.

VPS:
PROPERTIES: 4 GB RAM, 40GB SSD
SERVER: Ubuntu 16.04.5 LTS (GNU/Linux 4.4.0-141-generic x86_64)
PLESK: Plesk Onyx 17.8.11

• FPM application served by Apache with PHP 7.0.33 is used.
• Nginx Proxy Mode is enabled.
• piped logs feature is disabled.

 

[Brujo]

I do not even use ftp while I'm getting this alert level change error.

First at all this has nothing to do with ftp service, only that the user has "ftp" inside his name. In your case the "ftp_gam+" user is the User which is assigned to the domain / webspace and the webservice is running under the "ftp_gam+" user name.

How to check, for example the ownerchip of your webspace files&folder via cli or plesk panel file manager and you will see your domain webservice is running as "ftp_gam+"

 

[Meczup zade]

Hello, I didn't get the point.
By the way, I'm using Plesk on the VPS only for a website. What would be the problem about ownership or something else.

 

[Brujo]

maybe this will make it more clear.

see High CPU and memory usage by website

 

[Meczup zade]

This is why I wrote "FPM application served by Apache with PHP 7.0.33 is used. Nginx Proxy Mode is enabled. piped logs feature is disabled." at the end of my post.

Means, I've applied these before:
High CPU and memory usage by website
High CPU usage by Apache is shown in Health Monitor

 

[Bitpalast]

The cause is simply that the user whose name starts with ftp_gam is running PHP scripts that cause an excessive load on your system. The scripts must be altered or the user shut down. Normally, high load then it occurs in several PHP-FPM processes is caused by poorly written PHP scripts that stay in while-loops or have unecessary repetitions inside loops. It is possible too, that the user's domain is under attack or visited frequently by bad bots. They ought to be excluded from visiting the user's website.

 

[Meczup zade]

The cause is simply that the user whose name starts with ftp_gam is running PHP scripts that cause an excessive load on your system. The scripts must be altered or the user shut down. Normally, high load then it occurs in several PHP-FPM processes is caused by poorly written PHP scripts that stay in while-loops or have unecessary repetitions inside loops. It is possible too, that the user's domain is under attack or visited frequently by bad bots. They ought to be excluded from visiting the user's website.

Thanks for your answer. I have some questions after you.
- Is that possible to detect which php script uses much more resources?
- How can I detect these kindof bots.

Edit: Screenshots added. (apache ram usage)

 

[Meczup zade]

- I've deactivated all PHP-FPM versions (except one that I use)
- I've removed all PHP versions (except one that I use)

And the result is: