High CPU Usage on VPS

[LuDo8]

Hey guys, I get a lot of CPU spikes and I'm not quite sure how to fix it.

http://i.lulzimg.com/2e85d176e2.jpg
http://i.lulzimg.com/5b3174e9bc.jpg

It constantly goes from very low 0-2% to 50-99% as you can see from the two screenshots.

Its a 3GB 3 CPU Core VPS on Centos 5 64bit, Nginx, APC, and MySQL hosting about 2 wordpress sites with a combined daily traffic of about 6k UV/day.

For the VPS specs I know for a fact that is plenty of power for just 6k traffic. And the port connection is 100MBs and I can download from it 5-8MB/s just fine so its not that either.

It seems to be PHP-FPM thats using up all the CPU, but why? And how to fix it?

Thanks in advance

LuDo8 Reviewed by LuDo8 on 20th Jan 2012. High CPU Usage on VPS Hey guys, I get a lot of CPU spikes and I'm not quite sure how to fix it. http://i.lulzimg.com/2e85d176e2.jpg http://i.lulzimg.com/5b3174e9bc.jpg It constantly goes from very low 0-2% to 50-99% as you can see from the two screenshots. Its a 3GB 3 CPU Core VPS on Centos 5 64bit, Nginx, APC, and MySQL hosting about 2 wordpress sites with a combined daily traffic of about 6k UV/day. For the VPS specs I know for a fact that is plenty of power for just 6k traffic. And the port Rating: 5

[tut2tut]

Remove unwanted WP plugins

[LuDo8]

Tried disabling ALL plug-ins and the CPU usage is still the same, so that's not it.

Any other ideas?

[DXS]

Could be a DoS or DDoS attack? Sometimes these attacks can cause a high CPU load if it isn't the plugins. Maybe it's just you're experiencing more traffic at certain times? Plus...since you're on a VPS, maybe another site hosted on the VPS is reaching traffic peaks or they're getting attacked and causing your site to lag or get high CPU load or both. If you're not getting attacked or are getting attacked, talk to your host about the problem and maybe they can help you block attacks and prevent them from happening again or move you to a different VPS if it isn't you being attacked.

Log into SSH and read this thread to see if you're being attacked and how to stop it:
http://www.besthostingforums.com/13-...ables-ssh.html

[LuDo8]

Ran the command from the tutorial you linked, and the results were:

# netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n
      1 174.141.208.106
      1 174.141.208.108
      1 174.141.208.110
      1 174.141.208.113
      1 184.72.46.206
      1 222.124.59.162
      1 65.91.116.33
      1 65.91.116.34
      1 65.91.117.74
      1 65.91.117.75
      1 66.249.66.10
      1 66.56.8.38
      1 72.233.56.138
      1 80.237.226.74
      1 90.191.186.249
      1 95.13.67.18
      1 Address
      1 and
      2 174.141.208.102
      2 174.141.208.107
      2 174.141.208.109
      2 174.141.208.111
      2 174.141.208.112
      2 174.141.208.98
      2 184.72.46.156
      2 184.72.46.160
      2 199.59.149.166
      2 89.151.116.53
      3 174.141.208.100
      3 174.141.208.101
      3 174.141.208.103
      3 174.141.208.96
      3 174.141.208.97
      3 98.151.190.165
      4 174.141.208.99
      4 199.59.149.31
      4 41.237.211.167
      9 0.0.0.0
     14 86.75.10.55
     32 127.0.0.1
     44 69.31.50.114

Ran it again a few minutes later and it was all gone:

# netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n
      1 123.125.71.28
      1 161.69.220.1
      1 222.124.59.162
      1 41.237.211.167
      1 63.232.227.10
      1 67.170.253.61
      1 69.31.50.114
      1 85.100.150.63
      1 89.248.174.73
      1 Address
      1 and
      2 199.59.149.31
      2 79.95.147.166
      2 97.80.128.60
      3 98.151.190.165
      5 95.13.67.18
      6 24.151.180.193
      9 0.0.0.0
     23 127.0.0.1

So I don't think it's a DDoS..I keep thinking it has to do with my configurations since its showing PHP-FPM as the CPU hog, but you brought up a good point regarding someone else using up resources so I'll send a support ticket regarding that.

Thanks so far everyone who has replied. Any other ideas guys?

[DXS]

Might be configs then..

    44 69.31.50.114

I also highly doubt 44 connections from one IP is even remotely considered an attack.

Just change your settings maybe? try this method again though when you have high CPU usage...maybe we're both right. Maybe we're both wrong?

Anyway, if anyone doesn't have an answer, contact your host and see if they can help you. If you have a good host, they will help to the max and be very resourceful and helpful. Thanks tippie for being my wonderful host when I had a website.

[-Im.z2ight-]

Looks like an error.

[LuDo8]

And that error might be?

[tut2tut]

are you sure cpu load came from your site? as i know it's showing whole server cpu usage, few vps'es on the server..

contact your vps company,

[DLow]

tbh looks like mySQL