Sometimes some necessary processes use a lot of resources on the server and the system often starts to notify about it by email.
For example, as in my case, after installing the Zabbix agent, notifications began to come:
Suspicious process running under user zabbix
and
Excessive resource usage: zabbix
To exclude checks from Zabbix or other services, you need to open “ConfigServer Security & Firewall” at the very bottom of the WHM panel and in the section “lfd – Login Failure Daemon” where “Edit lfd ignore file” select “csf.pignore, Process Tracking”, click “Edit” and at the very bottom add the path to the running process, for example:
exe:/usr/sbin/zabbix_agentd
To apply the changes, click the “Change” button below.
Naturally, if the resources are used by an unknown process, script, etc., then it must be investigated.
See also my articles:
How to solve “LFD: Excessive resource usage”
How on Linux to learn the process PID and terminate it