@nebulon

@KhalilZammeli said in Cloudron services are slow:

update of the screenshot for our wordpress service, very high CPU usage, how can we investigate these ?

Given the above and the fact WordPress uses mysql (and is very often attacked as it's so widely used, and malicious plugins are also quite common) that seem to me to be the obvious first app to investigate.

Absolutely! Most of the time a WP plugin is the culprit. A WP plugin that's been acquired through a 'friend' which is not the original developer. Extremely, dangerous these are compromised in 99% of the times.

@KhalilZammeli said in Cloudron services are slow:

update of the screenshot for our wordpress service, very high CPU usage, how can we investigate these ?

Given the above and the fact WordPress uses mysql (and is very often attacked as it's so widely used, and malicious plugins are also quite common) that seem to me to be the obvious first app to investigate.

So then the question comes back to finding out which app seems to utilize the mysql service that heavily. Maybe you can also stop one app after the other to find out which one is the one causing that.

For the confusing user names: top command has no idea about containers. A uid in container will just appear as uid in host and top will blindly translate the uid not realizing that the uid is for the container. This is why you see mysqld running as netdtaa. Most likely mysqld is running in the mysql container and the mysqld user of container is mapped as netdata in host (i.e their uids are the same). See something like pstree to make out the pids

After further investigation into the server performance issues, we've identified some suspicious activity that may not be related to Cloudron itself. Here's a summary of our findings:

1. System and Security Checks Performed:
   • We confirmed that no software other than Cloudron was intentionally installed before today.
   • We reviewed recent command history to ensure no unintended actions were performed manually.
2. Unrecognized User Activity:
   • Initially, we noticed a MySQL instance running under the user pollinate, which is not part of Cloudron’s standard services.
   • Upon further analysis, we found that after removing the pollinate user, a new user with UID 106 took over running similar services, including MySQL, PostgreSQL, and MongoDB.
   • Most recently, these processes have transitioned to running under the netdata user, which we installed today for monitoring purposes.
     • is it possible it’s a malicious entity changing user each time ?
3. System Observations:
   • We have gathered the following screenshots for further analysis:

     • Service View Screenshot: (Attach the image)
       

     • System Info Screenshot: (Attach the image)
       

     • Top Command Output Screenshot: (Attach the image)
       

       update of the screenshot for our wordpress service, very high CPU usage, how can we investigate these ?
       

Next Steps:

• We're investigating if the unauthorized services were installed via a privilege escalation method.
• We're considering reinstallation of Cloudron on a fresh system if no other resolution is found.

Any insights or suggestions from the Cloudron team would be greatly appreciated.

Thank you for your continued support!

But that doesn’t give much info so I’m not sure

Your DB is super busy for some reason as well. So include the > Services view

Here are some additional info gathered by the team:

Platform Versionv8.2.3 (Ubuntu 24.04.1 LTS)
VendorQEMU
ProductStandard PC (i440FX + PIIX, 1996)
CPU6 Core "AMD EPYC 7282 16-Core Processor"
Memory16.77 GB RAM & 4.29 GB Swap

We noticed something is related to MySQL?