PHP-FPM often shows up in top when no one is on site

T

tagteam

Member
May 21, 2013
18
1
53
cPanel Access Level
Root Administrator
Often when I am watching top to see what is going on I will see php-fpm show up for a users account when no one is on the site. It will show up with around a 20% cpu hit and then go away. It will pop in and out for a while but as I am watching analytics no one is actually on the site.

Does anyone know why this is happening?
 
Last edited by a moderator:
T

tagteam

Member
May 21, 2013
18
1
53
cPanel Access Level
Root Administrator
Upon further review this appears to be bots hitting the site. For example one bot mj12bot.com hits it all the time. I disallowed that bot in the robots.txt file but it still seems to be hitting the site multiple times a minute. It mainly looks to be hitting my calendar.

144.91.125.96 - - [08/Dec/2020:11:25:36 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-24&paged=12 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:25:51 -0600] "GET /page/12/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-24 HTTP/1.1" 200 31386 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:02 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28&paged=2 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:13 -0600] "GET /page/2/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28 HTTP/1.1" 200 31383 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:26 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28&paged=6 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:34 -0600] "GET /page/6/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28 HTTP/1.1" 200 31380 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:48 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30&paged=6 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:57 -0600] "GET /page/6/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30 HTTP/1.1" 200 31381 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:27:10 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30&paged=8 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:27:22 -0600] "GET /page/8/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30 HTTP/1.1" 200 31381 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"


Can anyone confirm that this is what I am seeing? It appears to be coming from the same IP so I could block that i suppose but the mj12bot.com site says they user a range of ip's so if it is really them I don't know if it will help.
 
cPRex

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
15,235
2,422
363
cPanel Access Level
Root Administrator
Hey there! That traffic is definitely their bot, so you could block the IP you're currently seeing accessing the server. If you see the IP change in the future you could just block an additional IP. That is likely the best way to handle it as then Apache doesn't have to process that traffic at all on your system.
 
T

tagteam

Member
May 21, 2013
18
1
53
cPanel Access Level
Root Administrator
I blocked it in the morning and around 11:30. Then an hour later I see:

144.91.125.96 - - [08/Dec/2020:11:34:55 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-03-04&paged=6 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:35:04 -0600] "GET /page/6/?post_type=tribe_events&eventDisplay=day&eventDate=2016-03-04 HTTP/1.1" 200 31372 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
167.114.157.181 - - [08/Dec/2020:12:38:38 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
167.114.64.97 - - [08/Dec/2020:12:40:37 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
167.86.74.24 - - [08/Dec/2020:13:12:53 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
167.114.157.181 - - [08/Dec/2020:13:18:14 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
148.251.9.145 - - [08/Dec/2020:15:18:52 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
192.99.4.168 - - [08/Dec/2020:15:23:47 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
85.165.52.41 - - [08/Dec/2020:15:33:11 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"

So it looks like, maybe now they are stopping at the robots.txt and not scanning. Is that what I am seeing going on here?
 
You must log in or register to reply here.
Thread starter Similar threads Forum Replies Date
R disable cpanel_php_fpm via salt-stack Account Administration 1
H SOLVED php fpm consumes 100% cpu Account Administration 2
Ramon Pego PHP-FPM it's a good choice over traditional ? Account Administration 7
A How to restart php-fpm using SSH ? Account Administration 1
N SOLVED How to restart php-fpm using SSH ? Account Administration 3
Similar threads
disable cpanel_php_fpm via salt-stack
SOLVED php fpm consumes 100% cpu
PHP-FPM it's a good choice over traditional ?
How to restart php-fpm using SSH ?
SOLVED How to restart php-fpm using SSH ?
Top Bottom