My CPU spiking up

Do not post support requests, bug reports or feature requests. Discuss phpBB here. Non-phpBB related discussion goes in General Discussion!
Ideas Centre
Nick225
Registered User
Posts: 126
Joined: Sat Nov 24, 2018 7:48 pm

My CPU spiking up

Post by Nick225 » Mon Nov 11, 2019 7:24 pm

Something is killing my site. My CPU is spiking up, using all the resource and bringing my site to a halt. I asked godaddy for help but they say it's the application. On CPANEL I can my memory being used up.. It goes down to 50% then shoots right up to 98% and back and forth when no one is on the site.
I logged on SSH but don't really know what to look for..

How do I find which file causes this issue? All was fine until last week then this started happening.
Yesterday they moved me to a new plan, when I was telling then that is not issue and that the CPU would still be overran. They insisted I get more CPU. So I did.
But as I was expecting, it's been eaten up pretty quickly by the same overrunning process. I am constantly getting an "exceeded resource" message.
I am running phpbb 3.2 with php 7.2
Any suggestion?

Nick225
Registered User
Posts: 126
Joined: Sat Nov 24, 2018 7:48 pm

Re: My CPU spiking up

Post by Nick225 » Mon Nov 11, 2019 7:50 pm

I ran the top command.
And there is no process using more than 6% of CPU.
But the memory is used up.

Code: Select all

top - 12:50:13 up 2 days, 22:04,  1 user,  load average: 4.49, 3.99, 3.87
Tasks:  14 total,   6 running,   8 sleeping,   0 stopped,   0 zombie
Cpu(s): 68.7%us, 30.7%sy,  0.3%ni,  0.0%id,  0.0%wa,  0.0%hi,  0.3%si,  0.0%st
Mem:   2045680k total,  1938880k used,   106800k free,   180832k buffers
Swap:  1048572k total,        0k used,  1048572k free,   771432k cached

706253 tpffh28t  20   0  117m  12m 3588 R  4.3  0.6   0:00.13 lsphp
 706254 tpffh28t  20   0  278m  19m 4516 R  3.3  1.0   0:00.10 lsphp
 706257 tpffh28t  20   0  276m  17m 3776 R  3.0  0.9   0:00.09 lsphp
 706258 tpffh28t  20   0  274m  16m 3744 S  2.3  0.8   0:00.07 lsphp
 706259 tpffh28t  20   0  274m  16m 3708 S  2.3  0.8   0:00.07 lsphp
 706260 tpffh28t  20   0  273m  14m 3324 R  2.0  0.7   0:00.06 lsphp
 379045 tpffh28t  20   0  267m  14m 9604 S  0.7  0.7   3:07.65 lsphp
 706262 tpffh28t  20   0  271m  11m 2600 R  0.7  0.6   0:00.02 lsphp
 695477 tpffh28t  20   0  120m 1904  844 S  0.3  0.1   0:00.12 sshd
 706263 tpffh28t  20   0  269m  10m 2540 R  0.3  0.5   0:00.01 lsphp
 375787 tpffh28t  20   0  267m  14m 9600 S  0.0  0.7   0:28.81 lsphp
 695479 tpffh28t  20   0 11596 1700 1364 S  0.0  0.1   0:00.02 bash
 705182 tpffh28t  20   0 15048 1172  956 R  0.0  0.1   0:00.09 top
 706264 tpffh28t  20   0  267m 7152 1480 R  0.0  0.3   0:00.00 lsphp

Last edited by Nick225 on Mon Nov 11, 2019 7:55 pm, edited 1 time in total.

Nick225
Registered User
Posts: 126
Joined: Sat Nov 24, 2018 7:48 pm

Re: My CPU spiking up

Post by Nick225 » Mon Nov 11, 2019 7:53 pm

Code: Select all

ps -ef |grep php
5250718   375787       1  0 Nov10 ?        00:00:28 lsphp
5250718   379045       1  0 Nov10 ?        00:03:07 lsphp
5250718   706502  379045  4 12:52 ?        00:00:00 lsphp:blic_html/board/pdgame/yec_atpwta_results.php
5250718   706524  379045  4 12:52 ?        00:00:00 lsphp:blic_html/board/pdgame/yec_atpwta_results.php
5250718   706527  379045  6 12:52 ?        00:00:00 lsphp:/home/tpffh28tg8az/public_html/board/app.php
5250718   706529  379045  5 12:52 ?        00:00:00 lsphp:/tpffh28tg8az/public_html/board/viewtopic.php
5250718   706530  379045  4 12:52 ?        00:00:00 lsphp:/home/tpffh28tg8az/public_html/board/ucp.php
5250718   706531  379045  7 12:52 ?        00:00:00 lsphp:/tpffh28tg8az/public_html/board/viewforum.php
5250718   706533  379045  6 12:52 ?        00:00:00 lsphp:/tpffh28tg8az/public_html/board/viewtopic.php
5250718   706535  379045  3 12:52 ?        00:00:00 lsphp:/tpffh28tg8az/public_html/board/viewforum.php
5250718   706536  379045  0 12:52 ?        00:00:00 lsphp:/tpffh28tg8az/public_html/board/viewforum.php
5250718   706539  695479  0 12:52 pts/0    00:00:00 grep php
I don't see much here either

Code: Select all

ps -ef |grep php
5250718   375787       1  0 Nov10 ?        00:00:28 lsphp
5250718   379045       1  0 Nov10 ?        00:03:08 lsphp
5250718   706992  379045  5 12:53 ?        00:00:00 lsphp
5250718   706993  379045  4 12:53 ?        00:00:00 lsphp:/tpffh28tg8az/public_html/board/viewtopic.php
5250718   706994  379045  5 12:53 ?        00:00:00 lsphp:tg8az/public_html/board/pdgame/finaldrive.php
5250718   706995  379045  4 12:53 ?        00:00:00 lsphp:blic_html/board/pdgame/yec_atpwta_results.php
5250718   707000  379045  4 12:53 ?        00:00:00 lsphp:/tpffh28tg8az/public_html/board/viewtopic.php
5250718   707001  379045  7 12:53 ?        00:00:00 lsphp:/tpffh28tg8az/public_html/board/viewforum.php
5250718   707002  379045  5 12:53 ?        00:00:00 lsphp:/tpffh28tg8az/public_html/board/viewforum.php
5250718   707003  379045  5 12:53 ?        00:00:00 lsphp:/tpffh28tg8az/public_html/board/viewforum.php
5250718   707005  379045  2 12:53 ?        00:00:00 lsphp:/home/tpffh28tg8az/public_html/board/app.php

User avatar
warmweer
Registered User
Posts: 3216
Joined: Fri Jul 04, 2003 6:34 am
Location: Van Allen Belt ... well actually Belgium

Re: My CPU spiking up

Post by warmweer » Mon Nov 11, 2019 8:17 pm

Nick225 wrote:
Mon Nov 11, 2019 7:50 pm
...
Swap: 1048572k total, 0k used, 1048572k free, 771432k cached
This is strange, when memory starts getting low, I would expect some swapping ?
The year is 2192. The British Prime Minister visits Brussels to ask for an extension of the Brexit deadline. No one remembers where this tradition originated, but every year it attracts many tourists from all over the world.

Nick225
Registered User
Posts: 126
Joined: Sat Nov 24, 2018 7:48 pm

Re: My CPU spiking up

Post by Nick225 » Mon Nov 11, 2019 8:34 pm

Yeah.. this is not about getting extra memory. It's about stopping whatever is hogging up this process. And I can't see any high cpu using process.

Nick225
Registered User
Posts: 126
Joined: Sat Nov 24, 2018 7:48 pm

Re: My CPU spiking up

Post by Nick225 » Mon Nov 11, 2019 8:46 pm

Code: Select all

ps aux --sort -rss
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
5250718   723138  4.3  1.0 287056 21892 ?        Rs   13:45   0:00 lsphp:/tpffh28tg8az/public_html/board/viewtopic.php
5250718   723139  3.6  0.9 284816 19912 ?        Rs   13:45   0:00 lsphp:/tpffh28tg8az/public_html/board/viewtopic.php
5250718   723125  4.0  0.9 284948 19416 ?        Ss   13:45   0:00 lsphp:blic_html/board/pdgame/yec_atpwta_results.php
5250718   723140  2.6  0.8 282764 17316 ?        Ss   13:45   0:00 lsphp:/tpffh28tg8az/public_html/board/viewtopic.php
5250718   723137  5.0  0.7 121896 15908 ?        Rs   13:45   0:00 lsphp
5250718   723142  3.0  0.7 280708 15908 ?        Rs   13:45   0:00 lsphp:/tpffh28tg8az/public_html/board/viewtopic.php
5250718   723143  3.0  0.7 280512 15404 ?        Rs   13:45   0:00 lsphp:/home/tpffh28tg8az/public_html/board/ucp.php
5250718   723145  2.0  0.6 278436 13788 ?        Rs   13:45   0:00 lsphp:tg8az/public_html/board/pdgame/finaldrive.php
5250718   723147  2.0  0.6 278436 13784 ?        Rs   13:45   0:00 lsphp:blic_html/board/pdgame/yec_atpwta_results.php
5250718   375787  0.0  0.5 273604 11724 ?        Ss   Nov10   0:29 lsphp
5250718   379045  0.2  0.5 273604 11724 ?        Ss   Nov10   3:20 lsphp
5250718   695477  0.0  0.0 123508  2044 ?        S    12:16   0:00 sshd: tpffh28tg8az@pts/0
5250718   695479  0.0  0.0  11596  1700 pts/0    Ss   12:16   0:00 -bash
5250718   708415  0.0  0.0 139152  1436 ?        SN   12:58   0:00 pure-ftpd (IDLE)
5250718   723149  0.0  0.0  13080   948 pts/0    R+   13:45   0:00 ps aux --sort -rss
anything standing out here? I see no high mem usage by any of the processes

User avatar
WelshPaul
Registered User
Posts: 360
Joined: Tue Aug 19, 2014 2:09 pm

Re: My CPU spiking up

Post by WelshPaul » Mon Nov 11, 2019 9:52 pm

Check the traffic hitting your website. Probably find that your getting hit by those China based Bots/Scrapers and draining resources!

How many guests are showing online?

Nick225
Registered User
Posts: 126
Joined: Sat Nov 24, 2018 7:48 pm

Re: My CPU spiking up

Post by Nick225 » Mon Nov 11, 2019 9:58 pm

currently no guest users. but let me check in Cpanel

User avatar
WelshPaul
Registered User
Posts: 360
Joined: Tue Aug 19, 2014 2:09 pm

Re: My CPU spiking up

Post by WelshPaul » Mon Nov 11, 2019 9:59 pm

Nick225 wrote:
Mon Nov 11, 2019 9:58 pm
currently no guest users. but let me check in Cpanel
What is the website URL?

Maybe try blocking China and see if that resolves things temporary?

Nick225
Registered User
Posts: 126
Joined: Sat Nov 24, 2018 7:48 pm

Re: My CPU spiking up

Post by Nick225 » Mon Nov 11, 2019 10:03 pm

I see a bunch of 159.138.* from Hong Kong. Lots of them.
That could be the attacker.
Let me see if banning them makes any difference.

User avatar
WelshPaul
Registered User
Posts: 360
Joined: Tue Aug 19, 2014 2:09 pm

Re: My CPU spiking up

Post by WelshPaul » Mon Nov 11, 2019 10:06 pm

Nick225 wrote:
Mon Nov 11, 2019 10:03 pm
I see a bunch of 159.138.* from Hong Kong. Lots of them.
That could be the attacker.
Let me see if banning them makes any difference.
I doubt you're being attacked. Its probably just one of the many rogue bots hitting your URL. Find out the user agent and block it via your firewall.

Don't ban the IP server side or via acp as they will still eat up some resources as they would still be hitting your server.

Nick225
Registered User
Posts: 126
Joined: Sat Nov 24, 2018 7:48 pm

Re: My CPU spiking up

Post by Nick225 » Mon Nov 11, 2019 10:15 pm

ok.. how do I get the agent? All those IP start with 159.138.
Godaddy installed a firewall, but they had to remove it because no one could log in. We were all getting a firewall error. They wanted me to whitelist my IP. I told them that makes no sense because this is a forum and I can't whitelist every member.

User avatar
WelshPaul
Registered User
Posts: 360
Joined: Tue Aug 19, 2014 2:09 pm

Re: My CPU spiking up

Post by WelshPaul » Mon Nov 11, 2019 10:24 pm

Setup a free *cloudflare account and get your host to whitelist only cloudflares IP addresses as listed here:
https://www.cloudflare.com/ips/

Your server will only accept requests from cloudflares servers. Then use cloudflares firewall rules to block those naughty bots via their user agent!

*This will require a change of nameservers though.
Last edited by WelshPaul on Mon Nov 11, 2019 10:26 pm, edited 1 time in total.

Nick225
Registered User
Posts: 126
Joined: Sat Nov 24, 2018 7:48 pm

Re: My CPU spiking up

Post by Nick225 » Mon Nov 11, 2019 10:25 pm

WelshPaul wrote:
Mon Nov 11, 2019 10:24 pm
Setup a free *cloudflare account and get your host to whitelist only cloudflares IP addresses as listed here:
https://www.cloudflare.com/ips/

Your server will only accept requests from cloudflares servers. Then use cloudflares firewall rules to block those naughty bots!

*This will require a change of nameservers though.
Thank you so much!!!!!!!!!!!!

Nick225
Registered User
Posts: 126
Joined: Sat Nov 24, 2018 7:48 pm

Re: My CPU spiking up

Post by Nick225 » Mon Nov 11, 2019 10:28 pm

I enter the IP 159.138* and I keep getting an error message that "No IP addresses or hostnames defined"
I tried 159.138.* and still the same error. Doesn't go through. the only way to work is to enter the entire IP.
But there are tons of them starting with that string, with agents looking like this:

Code: Select all

Mozilla/5.0(Linux;Android 5.1.1;OPPO A33 Build/LMY47V;wv) AppleWebKit/537.36(KHTML,link Gecko) Version/4.0 Chrome/42.0.2311.138 Mobile Safari/537.36 Mb2345Browser/9.0
that's weird
Last edited by Nick225 on Mon Nov 11, 2019 10:34 pm, edited 1 time in total.

Post Reply

Return to “phpBB Discussion”