Random instances of 'systemd --user' running for 24 hours

[Kal]

I'm getting instances of 'systemd --user' running for 24 hours. They seem to start about 10 minutes after midnight, and run until the following midnight. The user account will be different each time, and I can't see any pattern to it—it just seems random.

CSF sends me two LFD 'Excessive resource usage' for 'Process Time' emails every hour that look like this:

Executable: /usr/lib/systemd/systemd
Command Line: /usr/lib/systemd/systemd --user
PID: 3390905 (Parent PID:3390905)

Executable: /usr/lib/systemd/systemd
Command Line: (sd-pam)
PID: 3390908 (Parent PID:3390905)

(Note the Parent PID of the first one is itself?)

When the clock rolls around to midnight, the alerts stop for that user. Then another one may start up for a different user, though not always. Occasionally there may be more than one user on the same day.

I could just silence the CSF warnings of course, but I'd prefer to know why this is happening and fix it if necessary. Any ideas?

 

[MaXi32]

For me, I always enable this option PT_LOAD_ACTION = myscript.sh in CSF. where if the load average is higher, it will automatically execute this myscript.sh. So, for example the myscript.sh contains another useful current process that is running. So you can debug this:

#!/bin/sh

#This script will be triggered from csf load warning. So always reported warning
#See /etc/csf/csf.conf to edit the path

REPORT_FILE="/var/log/csf/csf.report"
MAIL_BIN="/usr/local/bin/mail"
MYEMAIL="[email protected]"
MYHOSTNAME=`/bin/hostname`

echo "[csf | info]: CSF Server Load Checked on `date`" | tee -a $REPORT_FILE
echo "---------------------------------------------------" | tee -a $REPORT_FILE
cat /dev/null > $REPORT_FILE
iostat -d 1 5 | tee -a $REPORT_FILE
echo "---" | tee -a $REPORT_FILE
iostat -x -d 1 5 | tee -a $REPORT_FILE
echo "---" | tee -a $REPORT_FILE
mpstat -P ALL | tee -a $REPORT_FILE
echo "---" | tee -a $REPORT_FILE
top -b -n 1 | tee -a $REPORT_FILE
echo "---" | tee -a $REPORT_FILE
netstat -autpn | tee -a $REPORT_FILE
echo "---" | tee -a $REPORT_FILE
echo "---------------------------------------------------" | tee -a $REPORT_FILE

echo "[csf | info]: Status: WARNING" | tee -a $REPORT_FILE
echo "===================================================" | tee -a $REPORT_FILE
$MAIL_BIN -s "[csf | WARNING]: CSF Reported High Load Stress @ $MYHOSTNAME" $MYEMAIL < $REPORT_FILE

So, when CSF detected high load average, it will send you more details about this in email after executing myscript.sh. You can include other details as you need to debug this.