High CPU utilization by Fail2ban on Plesk server

Wondering how to resolve high CPU utilization by Fail2ban on Plesk server? We can help you.

At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Service.

Let’s take a look at how our Support Team help a customer  deal with this Plesk error.

How to resolve high CPU utilization by Fail2ban on Plesk server?

Fail2Ban is an intrusion prevention software framework that protects computer servers from brute-force attacks.

Written in the Python programming language, it is able to run on POSIX systems that have an interface to a packet-control system or firewall installed locally

Sometimes, Fail2ban consumes a lot of CPU

The /var/log/secure file has a big size and gets two new records each second:

tail -fn0 /var/log/secure

Sep 22 05:50:17 srv su: pam_unix(su-l:session): session closed for user popuser
Sep 22 05:50:17 srv su: pam_unix(su-l:session): session opened for user popuser by (uid=0)
Sep 22 05:50:18 srv su: pam_unix(su-l:session): session closed for user popuser
Sep 22 05:50:18 srv su: pam_unix(su-l:session): session opened for user popuser by (uid=0)

Usually, issue occurs due to large size of the /var/log/secure file.

Today, let us see the steps followed by our Support Techs to resolve it:

1. Firstly, log in to Plesk.

2. Then, disable ssh jail in Tools & Settings > IP Address Banning (Fail2Ban) > Jails.

3. Next, wait until the completion of Daily Maintenance task, i.e. the output of the following command is empty:

ps -auxwf | grep daily | grep -v grep

4. Execute the command below to rotate syslog files:

On CentOS/RHEL-based distributions:

logrotate -f /etc/logrotate.d/syslog

On Debian/Ubuntu-based distributions:

logrotate -f /etc/logrotate.d/rsyslog

5. Then, enable ssh jail in Tools & Settings > IP Address Banning (Fail2Ban) > Jails

6. Finally, check the CPU usage of fail2ban service:

top

[Need a solution to another query? We are just a click away.]

Conclusion

Today, we saw steps followed by our Support Engineers to resolve high CPU utilization by Fail2ban.

PREVENT YOUR SERVER FROM CRASHING!

Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

GET STARTED