php-fpm high cpu usage

[Keith1976]

Hi,

My VPS server has been running fine for many months but this morning at around 10am cpu usage has gone up hugely and the server and single website it hosts is extremely slow/unusable. I wasn't making any changes this morning and I see no signs of a DDOS or alerts in imunify360 or csf software.

PHP-FPM CPU usage is really high. Several processes showing 80% + for the 1 user with the WooCommerce website installed but as I said I didn't change anything today. Disabling all plugins and rolling back to an earlier WooCommerce version didn't help.

All in all I am a bit stuck. Any ideas for troubleshooting this?

Thanks, Keith

 

[cPRex]

Hey there! Is it possible that one user is experiencing an attack? If they are receiving much more traffic than normal, that would seem to be the most likely scenario. The fact that you see PHP-FPM just indicates that *something* with PHP is using resources on the machine.

A quick test would be to suspend the one account showing the 80% usage and see if the overall load drops. If so, the issue is either something within that account, or it is receiving too much/malicious traffic.

 

[Keith1976]

Hey there! Is it possible that one user is experiencing an attack? If they are receiving much more traffic than normal, that would seem to be the most likely scenario. The fact that you see PHP-FPM just indicates that *something* with PHP is using resources on the machine.

A quick test would be to suspend the one account showing the 80% usage and see if the overall load drops. If so, the issue is either something within that account, or it is receiving too much/malicious traffic.

Thanks for the quick reply.

The traffic seems completely normal for that account - it is the only account and is my own business website. This account is the root account.

If I suspend via WHM when I unsuspend will everything be as it was?

 

[Keith1976]

Hey there! Is it possible that one user is experiencing an attack? If they are receiving much more traffic than normal, that would seem to be the most likely scenario. The fact that you see PHP-FPM just indicates that *something* with PHP is using resources on the machine.

A quick test would be to suspend the one account showing the 80% usage and see if the overall load drops. If so, the issue is either something within that account, or it is receiving too much/malicious traffic.

I've suspended the account and the usage has gone down but not as much as I expected.

Edit to add: after a few more minutes for everything to settle down it seems to be back to normal usage with the account suspended. Traffic was normal on the account and nothing was changed when the cpu usage went up at 10am (8 gours ago).

 

[Keith1976]

I've unsuspended the account and it is instantly going slow and putting the CPU load up. PHP-FPM cpu usage is very high again.

There is definitely no increase in traffic. The site is in maintenance mode so traffic is actually much lower than normal.

I can't work out why the load started going up at 10am when nobody was making any changes to the website. Could something that updated within WHM, EasyApache or Imunify360 have caused it?

 

[cPRex]

Well, at least we have a clue that it's something related to that account. It might be time to scan the site for malware to see if there is any code running that shouldn't be that is contributing to the load.

 

[Keith1976]

Well, at least we have a clue that it's something related to that account. It might be time to scan the site for malware to see if there is any code running that shouldn't be that is contributing to the load.

I've tried running Imunify360's scan and WordFence Premium's but neither finished. I assume because the CPU load is too high. I do have realtime scanning enabled and it didn't alert me to any malware.

 

[cPRex]

Is the site using WordPress? If so, you could try disabling one plugin at a time and see if that makes a difference.

 

[Keith1976]

Is the site using WordPress? If so, you could try disabling one plugin at a time and see if that makes a difference.

Yes it is, I disabled every single plugin apart from WooCommerce and it still doesn't work.

 

[cPRex]

Instead of suspending the account, what if you replace the index page of the site with a blank index.txt file instead of the index.php, temporarily? This way, if there is a script running on the account, it won't be suspended, so you'd at least know if it's something in the site or something else in their account.

 

[Keith1976]

OK I've renamed index.php and uploaded a blank index.txt which results in the browser showing the text "file not found"

Now I check cpu usage?

Hmm actually when I go to /wp-admin/ for example it still loads normally so I don't think the blank index.txt is working.

 

[Keith1976]

Is this something I should submit a ticket for or would I be better trying to contact a Server Administrator?

This has come at a nightmare time for me as I'm due to go on holiday on Saturday and if this isn't fixed I won't be able to go.

 

[cPRex]

Since you've isolated the issue to one site, I don't think a cPanel ticket would be the best method to attack this, although we'd be happy to take a look. It would be better to reach out to a system administrator here: System Administration Services

 

[Keith1976]

Since you've isolated the issue to one site, I don't think a cPanel ticket would be the best method to attack this, although we'd be happy to take a look. It would be better to reach out to a system administrator here: System Administration Services

I will contact a System Admin from the list in the morning as it's almost midnight here.

How do I create a cPanel ticket? Is that a paid for service?

 

[cPRex]

If you have a cPanel license, it's free and you can do it directly from WHM.

 

[Keith1976]

Thanks I've submitted a ticket #95061751

 

[Keith1976]

Just to add Imunify360 completed a scan overnight and no malware was found. High CPU load persists.

 

[cPRex]

I do see we weren't able to access the server so far in the ticket, but I would still recommend pursuing a system administrator since we've already isolated the issue to the one domain.

 

[Keith1976]

I do see we weren't able to access the server so far in the ticket, but I would still recommend pursuing a system administrator since we've already isolated the issue to the one domain.

Yes I disabled sever access temporarily while my host looked into it. I didn't want 2 people making changes at the same time. Unfortunately the host only told me what I already knew - that PHP-FHM was consuming the resources.

As the site has been running fine for months if not years I am going to restore a full site and database backup from a few days ago. If that doesn't work then it'll be time for the system admin...

 

[Keith1976]

After weeks of running slow and me being on the verge on moving to a new server my VPS has just miraculously come back to life and is running at full speed again.

How can I check if background updates have been run that may have been fixed it?