When running ps aux on your VPS, you might encounter processes running under user ID (UID) 500, like the sw-cp-serverd service in your output:

500  23931  0.0  0.6  63764  6880  ?  S  08:49  0:01  /usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config

Let's break down the key components:

• UID 500: Historically, this was the first available user ID for regular users (UIDs below 500 were system accounts)
• sw-cp-serverd: This is the web server process for Plesk/SitePanel control panel
• Configuration file: Located at /etc/sw-cp-server/config

In this specific case, no immediate concern is needed. This is a legitimate process that:

1. Comes with Plesk installations
2. Manages the control panel's web interface
3. Runs with appropriate privileges

To confirm it's legitimate, you can:

# Check package ownership
rpm -qf /usr/sbin/sw-cp-serverd
# or on Debian/Ubuntu
dpkg -S /usr/sbin/sw-cp-serverd

# View process tree
pstree -p 23931

# Check open files
ls -l /proc/23931/fd

For comprehensive system monitoring:

# Install and configure auditd
sudo apt install auditd
sudo auditctl -a always,exit -F arch=b64 -S execve -k process_execution
sudo auditctl -w /usr/sbin/sw-cp-serverd -p warx -k plesk_web_server

To see which user corresponds to UID 500:

getent passwd 500
# Or search in /etc/passwd
grep ":500:" /etc/passwd

When examining the specific process line:

500  23931  0.0  0.6  63764  6880  ?  S  08:49  0:01  /usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config

We can decode each field:

• 500: The user ID (UID) running the process
• 23931: Process ID (PID)
• 0.0: CPU usage percentage
• 0.6: Memory usage percentage

In Linux systems, UID 500 typically represents a system user created during installation. Unlike regular users (usually starting from UID 1000), these are service accounts for daemons and system processes.

To check the actual username:

getent passwd 500

Sample output might show:

sw-cp-serverd:x:500:500:Service Account for sw-cp-serverd:/var/empty:/sbin/nologin

This is the control panel server daemon for ServerWise Control Panel, a web hosting management solution. The process running as UID 500 is completely normal behavior for this service.

To verify the package installation:

rpm -qf /usr/sbin/sw-cp-serverd
# or for Debian systems:
dpkg -S /usr/sbin/sw-cp-serverd

While the process itself is legitimate, consider these security checks:

# Check file permissions:
ls -la /usr/sbin/sw-cp-serverd

# Verify running processes:
sudo netstat -tulnp | grep sw-cp-serverd

# Check for unusual activity:
sudo grep sw-cp-serverd /var/log/auth.log

Common operations for sw-cp-serverd:

# Check status
systemctl status sw-cp-serverd

# Restart the service
sudo systemctl restart sw-cp-serverd

# Disable auto-start (if needed)
sudo systemctl disable sw-cp-serverd

Warning signs include:

• Unusually high CPU/memory usage
• Process running from unexpected locations
• Multiple instances running simultaneously

For deeper inspection:

# Check process memory map
pmap 23931

# Examine open files
lsof -p 23931