Keith1976

Member
Aug 8, 2021
18
2
3
England
cPanel Access Level
Root Administrator
Hi,

My VPS server has been running fine for many months but this morning at around 10am cpu usage has gone up hugely and the server and single website it hosts is extremely slow/unusable. I wasn't making any changes this morning and I see no signs of a DDOS or alerts in imunify360 or csf software.

PHP-FPM CPU usage is really high. Several processes showing 80% + for the 1 user with the WooCommerce website installed but as I said I didn't change anything today. Disabling all plugins and rolling back to an earlier WooCommerce version didn't help.

All in all I am a bit stuck. Any ideas for troubleshooting this?

Thanks, Keith
 
Last edited by a moderator:

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
16,505
2,605
363
cPanel Access Level
Root Administrator
Hey there! Is it possible that one user is experiencing an attack? If they are receiving much more traffic than normal, that would seem to be the most likely scenario. The fact that you see PHP-FPM just indicates that *something* with PHP is using resources on the machine.

A quick test would be to suspend the one account showing the 80% usage and see if the overall load drops. If so, the issue is either something within that account, or it is receiving too much/malicious traffic.
 
  • Like
Reactions: Keith1976

Keith1976

Member
Aug 8, 2021
18
2
3
England
cPanel Access Level
Root Administrator
Hey there! Is it possible that one user is experiencing an attack? If they are receiving much more traffic than normal, that would seem to be the most likely scenario. The fact that you see PHP-FPM just indicates that *something* with PHP is using resources on the machine.

A quick test would be to suspend the one account showing the 80% usage and see if the overall load drops. If so, the issue is either something within that account, or it is receiving too much/malicious traffic.
Thanks for the quick reply.

The traffic seems completely normal for that account - it is the only account and is my own business website. This account is the root account.

If I suspend via WHM when I unsuspend will everything be as it was?
 
Last edited:

Keith1976

Member
Aug 8, 2021
18
2
3
England
cPanel Access Level
Root Administrator
Hey there! Is it possible that one user is experiencing an attack? If they are receiving much more traffic than normal, that would seem to be the most likely scenario. The fact that you see PHP-FPM just indicates that *something* with PHP is using resources on the machine.

A quick test would be to suspend the one account showing the 80% usage and see if the overall load drops. If so, the issue is either something within that account, or it is receiving too much/malicious traffic.
I've suspended the account and the usage has gone down but not as much as I expected.

Edit to add: after a few more minutes for everything to settle down it seems to be back to normal usage with the account suspended. Traffic was normal on the account and nothing was changed when the cpu usage went up at 10am (8 gours ago).
 

Keith1976

Member
Aug 8, 2021
18
2
3
England
cPanel Access Level
Root Administrator
I've unsuspended the account and it is instantly going slow and putting the CPU load up. PHP-FPM cpu usage is very high again.

There is definitely no increase in traffic. The site is in maintenance mode so traffic is actually much lower than normal.

I can't work out why the load started going up at 10am when nobody was making any changes to the website. Could something that updated within WHM, EasyApache or Imunify360 have caused it?
 

Keith1976

Member
Aug 8, 2021
18
2
3
England
cPanel Access Level
Root Administrator
Well, at least we have a clue that it's something related to that account. It might be time to scan the site for malware to see if there is any code running that shouldn't be that is contributing to the load.
I've tried running Imunify360's scan and WordFence Premium's but neither finished. I assume because the CPU load is too high. I do have realtime scanning enabled and it didn't alert me to any malware.
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
16,505
2,605
363
cPanel Access Level
Root Administrator
Instead of suspending the account, what if you replace the index page of the site with a blank index.txt file instead of the index.php, temporarily? This way, if there is a script running on the account, it won't be suspended, so you'd at least know if it's something in the site or something else in their account.
 

Keith1976

Member
Aug 8, 2021
18
2
3
England
cPanel Access Level
Root Administrator
OK I've renamed index.php and uploaded a blank index.txt which results in the browser showing the text "file not found"

Now I check cpu usage?

Hmm actually when I go to /wp-admin/ for example it still loads normally so I don't think the blank index.txt is working.
 

Keith1976

Member
Aug 8, 2021
18
2
3
England
cPanel Access Level
Root Administrator
Is this something I should submit a ticket for or would I be better trying to contact a Server Administrator?

This has come at a nightmare time for me as I'm due to go on holiday on Saturday and if this isn't fixed I won't be able to go.
 

Keith1976

Member
Aug 8, 2021
18
2
3
England
cPanel Access Level
Root Administrator
Since you've isolated the issue to one site, I don't think a cPanel ticket would be the best method to attack this, although we'd be happy to take a look. It would be better to reach out to a system administrator here: System Administration Services
I will contact a System Admin from the list in the morning as it's almost midnight here.

How do I create a cPanel ticket? Is that a paid for service?
 

Keith1976

Member
Aug 8, 2021
18
2
3
England
cPanel Access Level
Root Administrator
I do see we weren't able to access the server so far in the ticket, but I would still recommend pursuing a system administrator since we've already isolated the issue to the one domain.
Yes I disabled sever access temporarily while my host looked into it. I didn't want 2 people making changes at the same time. Unfortunately the host only told me what I already knew - that PHP-FHM was consuming the resources.

As the site has been running fine for months if not years I am going to restore a full site and database backup from a few days ago. If that doesn't work then it'll be time for the system admin...
 
  • Like
Reactions: cPRex

Keith1976

Member
Aug 8, 2021
18
2
3
England
cPanel Access Level
Root Administrator
After weeks of running slow and me being on the verge on moving to a new server my VPS has just miraculously come back to life and is running at full speed again.

How can I check if background updates have been run that may have been fixed it?