5202T 99% CPU utilization

[JHASUSTOR]

Hi,
As I'm learning more about this NAS I was trouble shooting an issue I noted in another thread where the photo is not showing and the system behaving very sluggish compared to my circa 2014 WD NAS. I noticed the CPU is always at 99% even when there's no data being loaded or streamed. When I go into process tab, it shows nine instances of "lighttpd' that all add up to a significant amount of CPU utilization. What is this process for and is all this normal?

Thanks for any advice you can share.

[orion]

"lighttpd" is the daemon used by ADM web application. Normally the CPU usage is quite low, except you transfer files through ADM web page. I wonder process tab information is correct or not. If you can use ssh, you can check process loading manually. If it's indeed the root cause, I think you can try to reboot your NAS. I did not encounter this issue before. If it does not work, you should contact to asustor directly. https://support.asustor.com/

[JHASUSTOR]

Thank you Orion!
I'll have to read up on how to use ssh as I'm not very knowledgeable about the various ways data can be transferred. Just as another test I took a photo 117 minutes ago on my android phone. The image was uploaded immediately via the AiFoto android app into the SmartUpload folder of the NAS. I could view the new photo immediately from my PC. The android app has yet to show this new photo even though it uploaded immediately after taking it. I'll also reach out to support as you've kindly shared.

Thanks again!

[JHASUSTOR]

Update:

While reviewing the log to see if I can understand what might be causing this lag, I noticed in the System Information tab that the log is capturing multiple login failures from IP addresses I'm not familiar with.

I have the following messages with with differing IP addresses: [System] "sftp" login failure IP 58.87.xxx.xxx detected. Other IP addresses are 186.151.xxx.xxx. I'll even have one that says [Network Defender] Abnormal login attempt detected, Add IP "114.101.xxx.xxx" to Autoblock List. All these unrecognized IP addresses has me concerned. Can anyone shed light on this?

In an attempt to be safe I deactivated the original ADMIN login, I created another administrator user (AdminNew). Even after creating AdminNew user, changing the port number from 8000 and 8001 to XXXX and XXXY, I'm still seeing attempts from these unrecognized IP addresses in the log file.

Finally, another issue that came up is after creating a new administrator, I now can't view any of the folders or photos that were saved under the original Admin user. The AdminNew has a the same folders available but they are all empty. I hope I didn't loose all the data that was under the original Admin.

The only one positive is that after creating AdminNew, the CPU utilization is now hovering between 55% and 70%. But this is before re-installing AiFoto on the android phone and EZ Sync on the PC.

Appreciate any additional advice this community can offer.

Thank you!

[father.mande]

Hi,

It's not always the best to change admin user (UID) ... because you also break the access right to files and folders (system or access before by admin)
... this explain why you don't see the files ... you don't have the access (you can change it using root / your_admin_password ... but this require Linux command line knowledge. )
... Linux use UID (User ID the third value in /etc/passwd ) 999 for admin ... the name (admin) is just a facility more user friendly compare to UID.

The way to secure better your system is (without changing admin user UID) :
... change original port
... use A.D.M. defender in two way
... ... define a white list for your local LAN and VPN network
... ... auto black list (3 try in 1 mn) ... forever (select ssh, ADM, etc. depends of your usage)
... reduce the ports redirected to Internet (so no need in this case to change port) via (upnp IGD ... Ez-router menu) and use from Internet only secure access SSH (with another port than 22) or better VPN
... control if you have web server accessible from Internet that you use ONLY SSL ... and check all accessible folder (use .htaccess or blank index.html) to hide content for non-authorized users to limit access to folder you really want to have .

Philippe.

[JHASUSTOR]

Greetings Father.Mande,
Thank you for taking the time to reply. Your information was helpful and easy to understand for a novice/non-technical person such as myself. I will incorporate your advise to better secure my NAS. There appears to have been multiple attempts as the black list has numerous blocked ip addresses.

Since creating a new user my CPU has settled down to 30% =/- 5%. It also feels more responsive now. I hope going back to the original Admin user won't result in the same situation of maxing the CPU. Worse case I may back up to the PC and reset the NAS to factory default and start all over and use Father.Mande's advice.

Best to everyone!