find user for uid in lve stats: resource faults detected

[oceanwave]

In the LVE Stats: Resource faults detected email, there is a cpanel user, which is great.
There is also a line that says
UID 255 Username (blank) Domain (blank) Name (blank) CPU Limit, % 34 CPU Faults 5 IO Limit KB/s 2048 IO Faults 80
id -nu 255 gives no such user

Is there a way I can see which user the UID 255 in the LVE Stats: Resource faults detected email refers to?

I don't have mysql govenor enabled; I have not removed any cpanel accounts; I don't have any LVE user or package with a 34%CPU limit, and I have not manually configured any IO limit to 2048 KB/s

[bogdan.sh]

Hi,

Thf blank username is expected here. In CloudLinux the LVE ID is the account's UID, and lve-stats only shows a name when that UID exists in /etc/passwd as a normal user. UID 255 is in the low system range (real cPanel accounts get much higher UIDs), so it's not a customer, it's a system/service context.

Try this command to read the details:

lve-read-snapshot -i 255 -p 1d

Nine times out of ten it's a CloudLinux or panel system process, most often the usage-statistics collector (cloudlinux-summary), which runs in a reserved system LVE and sometimes logs small CPU/IO faults. The output above will show you the exact command line. And it could be disabled if so: https://cloudlinux.zendesk.com/hc/en...age-Statistics

[oceanwave]

Thank you!

The alert emais are very useful for actual cpanel users to alert me to when a site is under AI bot issue. But today this user 255 has been creating an hourly alert that is adding undesirable noise to the alert email.

Running the lve-read-snapshot --id 255 --period 1d it returns:
/opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/igs/v1/aibolit/ai-bolit...
and
/opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart ...

From the alert email, the last hour I got 360 IO Faults and 29 CPU faults from this UID 255
Previous hour there were 340 IO Faults and 32 CPU faults
From the lve-read-snapshot what I see are all io_faults from this UID 255

How can I keep alert emails enabled for the actual cpanel users to detect AI bots hitting the server, but not be distracted by these IO and CPU alerts for rustbolit and ai-bolit?

Can the IO limit of 2048 and CPU limit of 34% be increased for this lve, especially the IO limit?

[bogdan.sh]

That output explains it. LVE 255 isn't a customer or a stray account, it's the container Imunify uses to throttle its malware scanner on CloudLinux. When a scan runs, run-with-intensity applies lvectl set 255 ... and runs rustbolit/ai-bolit inside LVE 255, so all scan activity shows up under that ID.

The 34% CPU and 2048 KB/s IO limits are just Imunify's scan intensity level 2, so the faults only mean the scanner is bumping into its own cap. That's by design (Imunify keeping the scan from starving customer sites), so those faults are harmless and safe to ignore.

If you ever do want fewer of them, don't touch LVE 255 with lvectl directly, it gets re-applied on every scan. Raise the Malware Scanner CPU/IO intensity in Imunify instead (Settings > Malware). Higher intensity means a higher cap and fewer faults, at the cost of heavier CPU/IO while scans run.

You can check the current limits with

/usr/libexec/run-with-intensity show

But since it's just the scanner hitting its throttle, ignoring the alerts for 255 is perfectly fine.