Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


PHP-FPM 100% CPU
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

PHP-FPM 100% CPU

Hola LET!

Since the last weeks PHP-FPM on my production server is eating 100% CPU with the workers while the master is pretty low on RAM and CPU usage.

The sites hosted are small and have a really low amount of visitors so I am puzzled.

image

Where should I start looking?

[01-Jun-2014 03:43:02] NOTICE: error log file re-opened
[01-Jun-2014 03:52:07] WARNING: [pool www] server reached max_children setting (5), consider raising it
[01-Jun-2014 03:53:55] WARNING: [pool www] server reached max_children setting (5), consider raising it
[01-Jun-2014 03:55:45] WARNING: [pool www] server reached max_children setting (5), consider raising it
[01-Jun-2014 04:17:30] WARNING: [pool www] server reached max_children setting (5), consider raising it
[01-Jun-2014 04:19:37] WARNING: [pool www] server reached max_children setting (5), consider raising it
[01-Jun-2014 04:33:37] WARNING: [pool www] server reached max_children setting (5), consider raising it
[01-Jun-2014 05:09:46] WARNING: [pool www] server reached max_children setting (5), consider raising it
[01-Jun-2014 05:11:53] WARNING: [pool www] server reached max_children setting (5), consider raising it
[01-Jun-2014 05:32:16] WARNING: [pool www] server reached max_children setting (5), consider raising it
[01-Jun-2014 05:36:10] WARNING: [pool www] server reached max_children setting (5), consider raising it
[01-Jun-2014 14:14:29] NOTICE: [pool www] child 24281 exited with code 0 after 535.162160 seconds from start
[01-Jun-2014 14:14:29] NOTICE: [pool www] child 24352 started
[01-Jun-2014 14:15:20] NOTICE: [pool www] child 24282 exited with code 0 after 573.646168 seconds from start
[01-Jun-2014 14:15:20] NOTICE: [pool www] child 24356 started
[01-Jun-2014 14:15:51] NOTICE: [pool www] child 24298 exited with code 0 after 591.454601 seconds from start
[01-Jun-2014 14:15:51] NOTICE: [pool www] child 24357 started
[01-Jun-2014 14:15:54] NOTICE: [pool www] child 24300 exited with code 0 after 593.901904 seconds from start
[01-Jun-2014 14:15:54] NOTICE: [pool www] child 24358 started
[01-Jun-2014 14:24:27] NOTICE: [pool www] child 24352 exited with code 0 after 598.297337 seconds from start
[01-Jun-2014 14:24:27] NOTICE: [pool www] child 24395 started
[01-Jun-2014 14:25:18] NOTICE: [pool www] child 24356 exited with code 0 after 598.297559 seconds from start
[01-Jun-2014 14:25:18] NOTICE: [pool www] child 24399 started
[01-Jun-2014 14:25:48] NOTICE: [pool www] child 24357 exited with code 0 after 597.299231 seconds from start
[01-Jun-2014 14:25:48] NOTICE: [pool www] child 24401 started
[01-Jun-2014 14:25:51] NOTICE: [pool www] child 24358 exited with code 0 after 597.290729 seconds from start
[01-Jun-2014 14:25:51] NOTICE: [pool www] child 24402 started

^ latest error log

Comments

  • namhuynamhuy Member

    happened to me sometime ago http://lowendtalk.com/discussion/26757/php-fpm-uses-too-much-cpu#latest

    after set limit_reg and limit_conn php-fpm is pretty tame for me now, check your access log to see if you have unusual traffic

  • The weird thing is that it goes back to normal after some minutes.

    What would be the optimal rates for limit_reg and limit_conn for a site with a MyBB forum, a Wordpress blog and a DokuWiki wiki?

  • namhuynamhuy Member

    yup, same thing happened to me, php-fpm only went up when somebody scanning, normally it uses very little cpu. for limit_reg, test on your site and increase it slowly if your pages don't display correctly. for limit_conn i would say 3-5 is fine.

  • edited June 2014

    Thanks namhuy. I'll play around to see what works.

    And WTH: 20 MB access log for the forum and there is a Russian address that fills most of the log accessing memberlist and calender of the forum mostly.

    The log is full of this stuff.

    http://stopforumspam.com/ipcheck/146.185.232.231

  • namhuynamhuy Member
    edited June 2014

    in that case you can block specific ip with, but limit_reg with nodelay and limit_conn will help alot with php-fpm's cpu problem

    http://stopforumspam.com/ipcheck/146.185.232.231

    deny 146.185.232.231;

  • I've banned a few addresses including the one above via iptables.

  • MunMun Member
    edited June 2014

    You can use this stop forum spam ban list I created for nginx. Just download nbl.sh and run it once per day and you should limit the amount of crap hitting your site. http://cdn.content-network.net/nbl/

    Thanked by 1M66B
  • Do you use XCache/OPCache or similar opcode cache? They seem to cure "100% load plague" in most cases.

  • MunMun Member

    @Master_Bo said:
    Do you use XCache/OPCache or similar opcode cache? They seem to cure "100% load plague" in most cases.

    Probably not in this case, most of the load is from a spammer trying to fill as many posts as possible.

  • @Mun said:

    Probably not in this case, most of the load is from a spammer trying to fill as many posts as possible.

    I see. I have constructed automatically updated list of popular spam sources, and create ipset-based filtering on my sites. Amount of spam dropped significantly.

    If interested, I'll give links to sources of CIDRs/IPs I ban using this approach.

  • MunMun Member

    @Master_Bo said:
    If interested, I'll give links to sources of CIDRs/IPs I ban using this approach.

    By chance do you have one for Project Honey Pot?

    I built one currently off of stop forum spam.

  • @Mun said:

    By chance do you have one for Project Honey Pot?

    I haven't exactly from Project Honeypot.

    I use StopForumSpam, Infiltrated.net's list, DROP/EDROP from SpamHaus, myip.ms's list of blacklisted IPs, full bogons and IPDeny's list.

  • I am not running any PHP cache thing as mentioned above (just PHP APC). I went to end of the log and found some crawler crawling a lot of pages on the forum hosted on the server at the time where PHP-FPM was using 100% CPU. I simply banned that crawler address. I'll monitor the situation.

    None of the spambots has spammed anything because they can not register (StopForumSpam MyBB plugin keeps them away with other security plugins) but they can browse sites. And that one was probably a little too hardware because it filled like several pages of the log.

This discussion has been closed.