Wondering how to resolve high CPU utilization by Fail2ban on Plesk server? We can help you.

At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Service.

Let’s take a look at how our Support Team help a customer  deal with this Plesk error.

How to resolve high CPU utilization by Fail2ban on Plesk server?

Fail2Ban is an intrusion prevention software framework that protects computer servers from brute-force attacks.

Written in the Python programming language, it is able to run on POSIX systems that have an interface to a packet-control system or firewall installed locally

Sometimes, Fail2ban consumes a lot of CPU

The /var/log/secure file has a big size and gets two new records each second:

tail -fn0 /var/log/secure

Sep 22 05:50:17 srv su: pam_unix(su-l:session): session closed for user popuser
Sep 22 05:50:17 srv su: pam_unix(su-l:session): session opened for user popuser by (uid=0)
Sep 22 05:50:18 srv su: pam_unix(su-l:session): session closed for user popuser
Sep 22 05:50:18 srv su: pam_unix(su-l:session): session opened for user popuser by (uid=0)

Usually, issue occurs due to large size of the /var/log/secure file.

Today, let us see the steps followed by our Support Techs to resolve it:

1. Firstly, log in to Plesk.

2. Then, disable ssh jail in Tools & Settings > IP Address Banning (Fail2Ban) > Jails.

3. Next, wait until the completion of Daily Maintenance task, i.e. the output of the following command is empty:

ps -auxwf | grep daily | grep -v grep

4. Execute the command below to rotate syslog files:

On CentOS/RHEL-based distributions:

logrotate -f /etc/logrotate.d/syslog

On Debian/Ubuntu-based distributions:

logrotate -f /etc/logrotate.d/rsyslog

5. Then, enable ssh jail in Tools & Settings > IP Address Banning (Fail2Ban) > Jails

6. Finally, check the CPU usage of fail2ban service:

top

[Need a solution to another query? We are just a click away.]

Conclusion

Today, we saw steps followed by our Support Engineers to resolve high CPU utilization by Fail2ban.