Submitted by LeGiangAnh on Wed, 08/12/2015 - 06:16 Pro Licensee
Hi,
Recently (from last 2 days) I found that some /bin/php-cgi use too much CPU on my server, sometime it use over 100% CPU and cause my server stop working (cannot access to my website). Could you please help me to solve this?
Thanks, Giang Anh
Status:
Active
Comments
Submitted by andreychek on Wed, 08/12/2015 - 09:00 Comment #1
Howdy -- usually that means some component of your web application requires a lot of CPU, for some reason.
You may need to look into the web application that is being used, and the plugins it is running, to determine the cause of the high CPU usage.
However, some additional things you could look into --
You could always try switching the PHP Execution Mode to CGI to see if the same problem continues to occur. You can do that in Server Configuration -> Website Options.
Another option is to go into Administrative Options -> Edit Resource Limits. There, you can set per-process limits on CPU usage. You'd need to be careful there though, as any process going over that limit will be killed
Submitted by LeGiangAnh on Wed, 08/12/2015 - 09:54 Pro Licensee Comment #2
Hi,
I'm using Joomla 3 websites with Apache in my server. Already switch from FCGId to CGI Wrapper: https://goo.gl/oESJad Will keep you updated.
Submitted by andreychek on Wed, 08/12/2015 - 10:12 Comment #3
Great, let us know if that helps!
Submitted by LeGiangAnh on Wed, 08/12/2015 - 12:58 Pro Licensee Comment #4
Hi,
I used CGI but it didn't work. The /bin/php-cgi an appache still use too much CPU. Please help.
Thanks, Giang Anh
Submitted by andreychek on Wed, 08/12/2015 - 13:21 Comment #5
Well, we're unfortunately not familiar with your website or the plugins it's using, so we don't really know why it's using a lot of CPU.
You could always use the CPU restriction mentioned above, the one in Administrative Options -> Edit Resource Limits.
Another option is to review your Apache logs in $HOME/logs/access_log to determine what users are accessing. You could then do testing to determine why the parts of the site they're accessing are requiring so much CPU.
You could also try disabling plugins, to see if one or more of the plugins you're using is causing the problem.
Just to rule a couple of unrelated things out, what is the output of these two commands:
mailq | tail -1
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head -10
Submitted by LeGiangAnh on Wed, 08/12/2015 - 20:10 Pro Licensee Comment #6
Hi,
How I limit the process to not use to much CPU with these options? I see that there is no % CPU limitation option. https://goo.gl/SlaKs6 Here is the output of the command: https://goo.gl/xEaesE And here is the lastest log:
66.249.71.62 - - [13/Aug/2015:01:01:30 +0000] "GET /firm/46-chi-nha-nh-ca-ng-ty-cp-xua-t-kha-u-pha-n-ma-m-tinh-va-n HTTP/1.1" 200 33 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.79.227 - - [13/Aug/2015:01:01:35 +0000] "GET /su-kien/8-khoa-hoc HTTP/1.1" 200 33 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
174.34.156.130 - - [13/Aug/2015:01:01:53 +0000] "GET / HTTP/1.1" 200 33 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com/)"
66.249.79.44 - - [13/Aug/2015:01:02:00 +0000] "GET /images/easyblog_images/1016/b2ap3_small_offline-text.png HTTP/1.1" 200 33 "-" "Googlebot-Image/1.0"
123.30.235.235 - - [13/Aug/2015:01:02:04 +0000] "GET /index.php?option=com_easydiscuss&task=cron HTTP/1.0" 200 33 "-" "Wget/1.12 (linux-gnu)"
123.30.235.235 - - [13/Aug/2015:01:02:04 +0000] "GET /index.php?option=com_easysocial&cron=true&phrase=lamgamecron HTTP/1.0" 200 33 "-" "Wget/1.12 (linux-gnu)"
123.30.235.235 - - [13/Aug/2015:01:02:05 +0000] "GET /index.php?option=com_easyblog&task=cron HTTP/1.0" 200 33 "-" "Wget/1.12 (linux-gnu)"
210.211.106.52 - - [13/Aug/2015:01:02:06 +0000] "GET /ho-so/750-tin-nguyen HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.9 - - [13/Aug/2015:01:02:06 +0000] "GET /ho-so/746-truc-nguyen HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.96 - - [13/Aug/2015:01:02:07 +0000] "GET /ho-so/836-testemployer2 HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.48 - - [13/Aug/2015:01:02:08 +0000] "GET /ho-so/892-yeuanhsuotdoi0000 HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.29 - - [13/Aug/2015:01:02:09 +0000] "GET /ho-so/1236-buihuuloc-outlook-com HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.104 - - [13/Aug/2015:01:02:10 +0000] "GET /ho-so/1188-tuantran-tqt-gmail-com HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.29 - - [13/Aug/2015:01:02:10 +0000] "GET /ho-so/1066-havuong181293-gmail-com HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.35 - - [13/Aug/2015:01:02:11 +0000] "GET /dien-dan/index?format=feed&type=rss HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.24 - - [13/Aug/2015:01:02:12 +0000] "GET /dien-dan/index?format=feed&type=atom HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.9 - - [13/Aug/2015:01:02:13 +0000] "GET /tin-tuc/tags/listings/house-of-grudge?format=feed&type=rss HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
14.160.64.50 - - [13/Aug/2015:01:02:25 +0000] "GET /tin-game-dev/6312-nhung-khai-niem-can-biet-ve-kpis HTTP/1.1" 200 33 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36"
14.160.64.50 - - [13/Aug/2015:01:02:25 +0000] "GET /favicon.ico HTTP/1.1" 200 33 "http://lamgame.vn/tin-game-dev/6312-nhung-khai-niem-can-biet-ve-kpis" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36"
210.211.106.97 - - [13/Aug/2015:01:02:28 +0000] "GET /ho-so/836-testemployer2 HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.69 - - [13/Aug/2015:01:02:29 +0000] "GET /component/tags/tag/59 HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.30 - - [13/Aug/2015:01:02:29 +0000] "GET /ho-so/1046-takashiba-arai HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.18 - - [13/Aug/2015:01:02:30 +0000] "GET /ho-so/1236-buihuuloc-outlook-com HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.123 - - [13/Aug/2015:01:02:31 +0000] "GET /dien-dan/index?format=feed&type=rss HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
118.70.190.110 - - [13/Aug/2015:01:02:33 +0000] "GET /bai-blog/252-mau-ke-hoach-marketing HTTP/1.1" 200 33 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36"
118.70.190.110 - - [13/Aug/2015:01:02:36 +0000] "GET /favicon.ico HTTP/1.1" 200 33 "http://lamgame.vn/bai-blog/252-mau-ke-hoach-marketing" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36"
210.211.106.25 - - [13/Aug/2015:01:02:41 +0000] "GET /ho-so/masteryi/ HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.108 - - [13/Aug/2015:01:02:41 +0000] "GET /ban-be/duongpham HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.80 - - [13/Aug/2015:01:02:42 +0000] "GET /ho-so/thanhcao/ HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.74 - - [13/Aug/2015:01:02:42 +0000] "GET /ho-so/tdsmilee/ HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.22 - - [13/Aug/2015:01:02:42 +0000] "GET /ho-so/rikotori/ HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.99 - - [13/Aug/2015:01:02:45 +0000] "GET /cong-dong/huy-hieu/thanh-tich/minhhai HTTP/1.1" 301 253 "-" "Wada.vn Vietnamese Search"
210.211.106.87 - - [13/Aug/2015:01:02:45 +0000] "GET /cong-dong/points/lich-su/796-hieuntp2 HTTP/1.1" 301 253 "-" "Wada.vn Vietnamese Search"
210.211.106.4 - - [13/Aug/2015:01:02:45 +0000] "GET /cong-dong/points/lich-su/794-hads2904 HTTP/1.1" 301 253 "-" "Wada.vn Vietnamese Search"
210.211.106.80 - - [13/Aug/2015:01:02:46 +0000] "GET /cong-dong/points/lich-su/759-thinh-le HTTP/1.1" 301 253 "-" "Wada.vn Vietnamese Search"
210.211.106.57 - - [13/Aug/2015:01:02:46 +0000] "GET /cong-dong/points/lich-su/762-hieu-bui HTTP/1.1" 301 253 "-" "Wada.vn Vietnamese Search"
174.34.162.242 - - [13/Aug/2015:01:02:53 +0000] "GET / HTTP/1.1" 200 33 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com/)"
66.249.71.78 - - [13/Aug/2015:01:02:56 +0000] "GET /images/easyblog_images/1016/b2ap3_small_Unity5-700x441.jpg HTTP/1.1" 200 33 "-" "Googlebot-Image/1.0"
66.249.71.66 - - [13/Aug/2015:01:03:02 +0000] "GET /su-kien/6-general-2 HTTP/1.1" 200 33 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
210.211.106.65 - - [13/Aug/2015:01:03:05 +0000] "GET /ho-so/701-thupha HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.45 - - [13/Aug/2015:01:03:05 +0000] "GET /ho-so/797-huonta HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.30 - - [13/Aug/2015:01:03:05 +0000] "GET /ho-so/726-ngunam HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.2 - - [13/Aug/2015:01:03:06 +0000] "GET /ho-so/689-augleo HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
210.211.106.81 - - [13/Aug/2015:01:03:06 +0000] "GET /ho-so/672-ai-tla HTTP/1.1" 200 33 "-" "Wada.vn Vietnamese Search"
Submitted by LeGiangAnh on Wed, 08/12/2015 - 20:20 Pro Licensee Comment #7
Here is the whole access log file: https://www.dropbox.com/s/77ggqi8phnsdzyc/access_log?dl=0 And error log file: https://www.dropbox.com/s/6cjt60dovkd4sc4/error_log?dl=0
Submitted by andreychek on Wed, 08/12/2015 - 21:17 Comment #8
Ah, you're right, it doesn't allow you to restrict CPU percent, it's only CPU time (in seconds).
We're not able to determine the cause of the issue by looking at your Apache logs, that's only something your website's developer would be able to review and determine.
However, I can offer that the output of the "netstat" command you ran shows that one particular IP address has 1632 open connections to your server.
If you see any IP addresses with a high number of connections to your server more than a few hundred), you may want to consider blocking that IP address. It's possible that your site is experiencing a DoS from that IP address.
Submitted by LeGiangAnh on Wed, 08/12/2015 - 22:33 Pro Licensee Comment #9
Could you please tell me how to block an IP? I Google and tried to use firewalld to block it but if I enable the firewalld, I cannot access to Virtualmin and my sites anymore.
Submitted by LeGiangAnh on Wed, 08/12/2015 - 23:24 Pro Licensee Comment #10
Since I cannot use firewalld, I installed iptables and use the following command
iptables -I INPUT -s 100.77.194.116 -j DROP
However the result is not better: https://goo.gl/W4wb0sThanks, Giang Anh
Submitted by andreychek on Thu, 08/13/2015 - 10:10 Comment #11
Glad you were able to block that IP! The first step is to verify that it is indeed blocked, and that no other IP addresses are hitting your server.
If you run the netstat command above again, what output do you receive now? Do all the IP addresses it shows have less than a hundred connections or so?
Submitted by LeGiangAnh on Thu, 08/13/2015 - 10:50 Pro Licensee Comment #12
Hi,
Here it is:
[root@jreplay1 ~]# mailq | tail -1
-- 54 Kbytes in 12 Requests.
[root@jreplay1 ~]# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head -10
8 100.77.194.116
7 171.249.12.120
4 157.56.29.55
4 157.55.196.71
3 173.252.73.119
3 173.252.73.117
2 207.46.225.194
2 173.252.73.116
2 173.252.73.115
2 127.0.0.1
[root@jreplay1 ~]#
Submitted by andreychek on Thu, 08/13/2015 - 19:29 Comment #13
Yes, your netstat command does look good.
Okay, it sounds like you may be seeing a PHP/website issue then.
Unfortunately, we're not able to say why the PHP code being run is requiring a lot of CPU. You may need to work with a web developer to determine what Joomla is doing that's so CPU intensive.
You could try disabling Joomla plugins to see if that helps.
But ultimately you may need to work with a web developer to determine the cause of this issue.
Submitted by LeGiangAnh on Thu, 08/13/2015 - 21:24 Pro Licensee Comment #14
Hi,
I make those website but I'm using Joomla so I don't have much experience. It seems that some sites have pike CPU usage, not only one.
Submitted by andreychek on Wed, 08/19/2015 - 00:25 Comment #15
What is the load average you are seeing when this occurs? You can determine that by running the "uptime" command.
This may mean that your server doesn't have enough resources for the sites currently running on them.
You may want to try disabling any Joomla plugins that you don't require in the sites that you're having problems with.
Sometimes plugins can cause unusual problems.
You may also want to look into Joomla caching tools. There are a number of Joomla caching plugins out there that may be able to assist in the problem you're seeing.