My server OS is centOS. I use Apache for httpd. Every site runs PHP by own user.
One of my sites (let's say that 504domain.com) gives 504 gateway error constantly. Restarting Apache makes the site available for a day. Rarely all the other sites affected by this 504. When 504 happens SSH connection works normally which means it's not a DDoS.
When I htop, I see php-fpm pool processes are running and stopping from all sites by their own user which is normal. But 6 process of 504domain.com php-fpm are running non stop. If I stop httpd, all php-fpm processes are gone as expected but after I restart httpd all 6 processes of 504domain.com are coming back.
Do you thing the site malicious code? How can I find which script is looping?