1

I have a server at DigitalOcean, and it mostly used to run a couple of low traffic WP sites, and 90% of the sites are running fine. BUT! one of the sites, is constantly having 5-20 (depends on what i put max children on) and each process is eating anywhere from 5%-20% CPU as can be seen here. It stays like that on all times a day, but i suspect it get worse the more active users their is.
Restarting php-fpm, or any of the other services doesn't help - i have looked in the log i cant really find anything i think would cause this problem.

I'm still very new at the whole server thing, and i have to say I'm not really sure what is causing this. But if somebody could point me in the right direction, i would appreciate it!

A little information:

DigitalOcean Droplet (4gb ram, 2 CPUs)
CentOS 7.3.1611 x64
nginx / php-fpm
Running WP sites (6-7 sites)

PHP-fpm.conf

 listen = 127.0.0.1:9001
 listen.allowed_clients = 127.0.0.1

 user = int
 group = int

 pm = dynamic
 pm.max_children = 10
 pm.start_servers = 3
 pm.min_spare_servers = 2
 pm.max_spare_servers = 10
 pm.max_requests = 300

 env[HOSTNAME] = $HOSTNAME
 env[PATH] = /usr/local/bin:/usr/bin:/bin
 env[TMP] = /tmp
 env[TMPDIR] = /tmp
 env[TEMP] = /tmp

Nginx.conf:

limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:40m;
limit_req_zone $binary_remote_addr zone=req_limit_per_ip:40m rate=20r/s;

server {
listen      114.242.22.180:80;
server_name int www.int;
root        /home/int/web/int/public_html;
index       index.php index.html index.htm;
access_log  /var/log/nginx/domains/int.log combined;
access_log  /var/log/nginx/domains/int.bytes bytes;
error_log   /var/log/nginx/domains/int.error.log error;


limit_conn conn_limit_per_ip 40;
limit_req zone=req_limit_per_ip burst=40 nodelay;

location = /wp-login.php {
    allow xxx.xxx.xxx.xxx;
    deny all;
}


location = /favicon.ico {
    log_not_found off;
    access_log off;
}

location = /robots.txt {
    allow all;
    log_not_found off;
    access_log off;
}

location / {
        index index.php index.html index.htm;
    try_files $uri $uri/ /index.php?$args;
    location ~* ^.+\.(jpeg|jpg|png|gif|bmp|ico|svg|css|js)$ {
        expires     max;
    }

     location ~ ^(.+\.php)(.*)$ {
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        if (!-f $document_root$fastcgi_script_name) {
            return  404;
        }
    fastcgi_split_path_info  ^(.+\.php)(.*)$;
        fastcgi_pass    127.0.0.1:9001;
        fastcgi_index   index.php;
        include         /etc/nginx/fastcgi_params;
    }
}

error_page  403 /error/404.html;
error_page  404 /error/404.html;
error_page  500 502 503 504 /error/50x.html;

location /error/ {
    alias   /home/int/web/int/document_errors/;
}

location ~* "/\.(htaccess|htpasswd)$" {
    deny    all;
    return  404;
}

location /vstats/ {
    alias   /home/int/web/int/stats/;
    include /home/int/web/int/stats/auth.conf*;
}

include     /etc/nginx/conf.d/phpmyadmin.inc*;
include     /etc/nginx/conf.d/phppgadmin.inc*;
include     /etc/nginx/conf.d/webmail.inc*;

include     /home/int/conf/web/nginx.int.conf*;
}
  • Check caching on the sites. Maybe you have some different plugin in one site that causes the extra load. – Tero Kilkanen Feb 28 '17 at 16:03
  • No unusual plugins on it :( – Mac Feb 28 '17 at 21:22
  • It looks like your website is being used, which is usually the point of a website. However if you can show that it's not being used (edit your post to include usage statistics) then you could give us more information, such as top / atop to show what's using CPU. It could just be an errant process. – Tim Mar 1 '17 at 1:18
  • I have been monitoring connections meanwhile, and it rarely went beyond 10-15 active connections - and top had a constant 5-10 active php-fpm process, running at 5-20% each. I gave the server a reboot, and its basicly down to normal levels now. – Mac Mar 1 '17 at 7:51
  • This should be closed since a reboot fixed it. – chicks Mar 20 '17 at 23:55
0

We can see that the CPU is being used, but which process is using it all up? PHP-FPM? MySQL? NginX? How often you get logs in your access.log file from NginX? Isn't it constant? If it is constant then you might be under DDoS attack.

If all above is: yes Cloudflare or Fail2Ban is required (forme, I have both)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.