This morning I received a notice that my server was at 100% CPU utilization and after running top, the offending component is whois.

I've searched and can't find any help on-line.

I restarted the server and that didn't help.

I am running fail2ban and did find some references to some issues there, but I'm not scanning the offending components mentioned in those sources.

How do I go about stopping whois and/or resetting what it's doing/why its stuck? Any suggestions or ideas?

Can't you just kill the process? Do a ps aux | grep whois command, find the pid and execute kill <pid>.

If it refuses to shutdown you can do kill -9 <pid>

As for fail2ban, been a while since I used it but I believe it does use (or can use) whois.. Can you whois things manually? Or does that not work either? Is your stuff up-to-date? Looked through fail2ban logs?

Thanks Nuvini... I just assumed a reboot would kill the process. I did the kill and it's gone... for now.

And yes, fail2ban does use whois. I will monitor at the next fail2ban notification to make sure whois didn't get stuck at 100% again.

And I do keep the stuff up to date. I probably need to look for a better option over F2B...