MYSQL high CPU usage

mikajaxxx · Dec 15, 2021

johannes said:
whats about to block 194.5.73.0/24 in CSF ?
.. btw this ip seems to belong to a security company - www.divd.nl , maybe they playing with your server?

I blocked that ip and seems cpu overload is gone. i should check cpu again tomorrow because highest load was on the around 10 ~12 AM

mikajaxxx · Dec 15, 2021

johannes said:
whats about to block 194.5.73.0/24 in CSF ?
.. btw this ip seems to belong to a security company - www.divd.nl , maybe they playing with your server?

Special Thanks for @Zhenyapan & @johannes
You are Super smart guys & thank you for your knowledge. Ok! the problem comes from that ip! after blocking, max process is just 1% everything become much faster (at least 10 times faster) and the server is super fast. but how that ip could access my server? why csf didnt block it? where that comes from? is there a malware on my server? how i could find the real problem?
i am using openlitespeed + exim + spamassasin
anyone could help me find the source of problem in my server?
there is no sign of "/usr/sbin/mysqld --daemonize --pid-file=/var/run/mysqld/mysqld.pid" & "/private_html/index.ph_room_to_avoid_overwrite_important_env" in process monitoring anymore!!!!!!

johannes said:
ClamAV, maldet (LMD - Linux Malware Detect), RKhunter

i installed ClamAV and scaned my vps , no success!

Zhenyapan · Dec 15, 2021

there was just a lot of requests from single IP, that didn't mean that server broken, just someone trying to hack/overload it. you blocked this IP now just monitor for new attempts

mikajaxxx · Dec 16, 2021

is there any options on csf to prevent such attacks?

Ohm J · Dec 16, 2021

you can't prevent, but you can reduce load.

Example, Attack with 1000K per second,
this can't fully reduce, so you need hardware to fight again attack too,

Just play with csf firewall, It your server. It your decision.
Eg. Use PORTFLOOD Protection option.

mikajaxxx · Jan 31, 2022

Hello
here is full log for slowing my server. the problem keep coming back. sometimes the average load goes on 70!

FULL LOG HAS BEEN ATTACHED

Code:

This is an automated message notifying you that the 5 minute load average on your system is 53.93.
This has exceeded the 10 threshold.

One Minute      - 60.63
Five Minutes    - 53.93
Fifteen Minutes - 32.85

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
 1609 mysql     20   0 1635980 483552      0 S  36.0 12.8  70:45.36 /usr/sbin/mysqld --daemonize --pid-file=/var/run/mysqld/mysqld.pid
14420 havasite  20   0  409004  39516  19408 R   4.0  1.0   0:23.63 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
17314 valatan   20   0  406948  35788  15444 R   4.0  0.9   0:00.97 lsphp:tan/domains/valatan.com/private_html/index.ph_room_to_avoid_overwrite_important_env
17430 valatan   20   0  398760  29360  17728 R   4.0  0.8   0:00.39 lsphp:tan/domains/valatan.com/private_html/index.ph_room_to_avoid_overwrite_important_env
17519 valatan   20   0  398300  22772  10904 R   4.0  0.6   0:00.14 lsphp:tan/domains/valatan.com/private_html/index.ph_room_to_avoid_overwrite_important_env
17538 havasite  20   0  397924  16328   7536 R   4.0  0.4   0:00.07 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
 4518 qnptr310  20   0  405428  37416  20724 R   2.7  1.0   0:44.14 lsphp:/domains/qnptrading.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14415 havasite  20   0  408744  37156  17284 R   2.7  1.0   0:23.73 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14419 havasite  20   0  408744  37560  17592 R   2.7  1.0   0:23.74 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14427 havasite  20   0  408956  43988  23772 R   2.7  1.2   0:23.52 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14428 havasite  20   0  408744  37268  17268 R   2.7  1.0   0:23.65 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14429 havasite  20   0  408744  37264  17292 R   2.7  1.0   0:23.52 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14430 havasite  20   0  408744  37676  17644 R   2.7  1.0   0:24.17 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14431 havasite  20   0  409136  39592  19916 R   2.7  1.0   0:23.81 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14433 havasite  20   0  408956  43576  23620 R   2.7  1.2   0:23.98 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14434 havasite  20   0  408744  37280  17616 R   2.7  1.0   0:23.70 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14436 havasite  20   0  408744  37212  17272 R   2.7  1.0   0:23.90 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14437 havasite  20   0  408744  37568  17692 R   2.7  1.0   0:23.55 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14442 havasite  20   0  408956  44000  23800 R   2.7  1.2   0:23.44 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14754 valatan   20   0  286968  17788  14456 R   2.7  0.5   0:07.45 lsphp
15786 havasite  20   0  408744  37248  17696 R   2.7  1.0   0:09.35 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
15957 valatan   20   0  404960  35640  19016 R   2.7  0.9   0:04.41 lsphp:tan/domains/valatan.com/private_html/index.ph_room_to_avoid_overwrite_important_env
16462 sarvrang  20   0  289520  12476   7256 R   2.7  0.3   0:00.54 lsphp:/domains/sarvrangco.com/private_html/index.ph_room_to_avoid_overwrite_important_env

Connection counts:
      4 103.74.109.34
      4 117.111.4.39
      4 12.252.97.86
      4 14.226.38.106
      4 157.55.39.153
      4 170.238.180.2
      4 175.223.27.4
      4 177.10.202.107
      4 177.40.193.39
      4 182.52.52.163
      4 186.236.1.203
      4 187.58.135.42
      4 190.205.42.42
      4 190.220.1.173
      4 191.53.47.118
      4 204.10.182.34
      4 207.46.13.121
      4 31.59.2.134
      4 41.57.141.113
      4 43.228.112.98
      4 45.127.222.89
      4 45.167.80.2
      4 45.231.29.26
      4 49.128.184.76
      4 50.235.117.234
      4 50.246.120.125
      4 58.75.126.235
      4 72.195.114.184
      4 8.37.43.219
      4 98.103.88.147
      4 98.162.25.23
      4 98.162.96.52
      4 98.175.31.195
      5 113.161.70.165
      5 115.227.232.168
      5 117.251.195.85
      5 118.122.77.201
      5 14.207.81.4
      5 154.64.217.128
      5 157.55.39.234
      5 160.0.203.106
      5 170.247.202.20
      5 171.220.241.242
      5 173.195.27.130
      5 173.25.228.107
      5 177.143.128.37
      5 178.72.90.70
      5 186.39.100.193
      5 202.44.228.168
      5 205.177.85.130
      5 216.250.107.62
      5 222.252.48.241
      5 23.148.64.71
      5 24.214.238.54
      5 70.60.96.154
      5 74.62.55.193
      5 84.236.185.247
      5 91.238.55.86
      5 98.162.96.53
      6 103.144.170.22
      6 154.73.66.16
      6 64.27.10.3
      6 82.163.35.84
      6 92.38.184.241
      7 138.122.22.15
      7 183.89.192.38
      7 192.111.135.17
      7 31.15.89.51
      7 47.89.26.158
      7 72.221.196.157
      8 103.79.35.44
      8 68.71.249.153
      8 70.60.230.8
      8 92.38.171.51
      9 174.64.199.82
      9 192.252.215.5
      9 192.252.220.92
      9 218.82.112.227
      9 64.92.208.183
      9 67.201.33.9
     10 70.63.165.22
     11 72.210.252.137
     11 98.170.57.231
     12 72.49.49.11
     14 14.207.28.243
     14 91.243.81.245
     15 213.19.205.18
     15 216.215.126.106
     17 184.178.172.18
     17 70.166.167.36
     19 142.44.136.97
     19 184.181.217.210
     19 192.252.215.2
     20 8.40.133.10
     23 198.8.94.170
     25 184.179.216.130
     38 81.134.144.161
     47 213.186.33.99
     65 178.212.199.95
    278 127.0.0.1

IP '127.0.0.1' currently has '304' connections

Dashboard > My Messages
DirectAdmin Web Control Panel © 2022 JBMC Software
Message
Warning: The system load average is 53.93
2022-01-31 12:29


This is an automated message notifying you that the 5 minute load average on your system is 53.93.
This has exceeded the 10 threshold.

One Minute      - 60.63
Five Minutes    - 53.93
Fifteen Minutes - 32.85

top - 08:59:18 up 10:38,  0 users,  load average: 61.78, 54.28, 33.08
Tasks: 313 total,  70 running, 243 sleeping,   0 stopped,   0 zombie
%Cpu(s): 60.8 us, 37.2 sy,  0.0 ni,  0.0 id,  0.0 wa,  0.0 hi,  2.0 si,  0.0 st
KiB Mem :  3781860 total,   122896 free,  2910004 used,   748960 buff/cache
KiB Swap:  4194300 total,  2020764 free,  2173536 used.   104096 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
 1609 mysql     20   0 1635980 483552      0 S  36.0 12.8  70:45.36 /usr/sbin/mysqld --daemonize --pid-file=/var/run/mysqld/mysqld.pid
14420 havasite  20   0  409004  39516  19408 R   4.0  1.0   0:23.63 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
17314 valatan   20   0  406948  35788  15444 R   4.0  0.9   0:00.97 lsphp:tan/domains/valatan.com/private_html/index.ph_room_to_avoid_overwrite_important_env
17430 valatan   20   0  398760  29360  17728 R   4.0  0.8   0:00.39 lsphp:tan/domains/valatan.com/private_html/index.ph_room_to_avoid_overwrite_important_env
17519 valatan   20   0  398300  22772  10904 R   4.0  0.6   0:00.14 lsphp:tan/domains/valatan.com/private_html/index.ph_room_to_avoid_overwrite_important_env
17538 havasite  20   0  397924  16328   7536 R   4.0  0.4   0:00.07 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
 4518 qnptr310  20   0  405428  37416  20724 R   2.7  1.0   0:44.14 lsphp:/domains/qnptrading.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14415 havasite  20   0  408744  37156  17284 R   2.7  1.0   0:23.73 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14419 havasite  20   0  408744  37560  17592 R   2.7  1.0   0:23.74 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14427 havasite  20   0  408956  43988  23772 R   2.7  1.2   0:23.52 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14428 havasite  20   0  408744  37268  17268 R   2.7  1.0   0:23.65 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14429 havasite  20   0  408744  37264  17292 R   2.7  1.0   0:23.52 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14430 havasite  20   0  408744  37676  17644 R   2.7  1.0   0:24.17 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14431 havasite  20   0  409136  39592  19916 R   2.7  1.0   0:23.81 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14433 havasite  20   0  408956  43576  23620 R   2.7  1.2   0:23.98 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14434 havasite  20   0  408744  37280  17616 R   2.7  1.0   0:23.70 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14436 havasite  20   0  408744  37212  17272 R   2.7  1.0   0:23.90 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14437 havasite  20   0  408744  37568  17692 R   2.7  1.0   0:23.55 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14442 havasite  20   0  408956  44000  23800 R   2.7  1.2   0:23.44 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
14754 valatan   20   0  286968  17788  14456 R   2.7  0.5   0:07.45 lsphp
15786 havasite  20   0  408744  37248  17696 R   2.7  1.0   0:09.35 lsphp:te/domains/havasite.com/private_html/index.ph_room_to_avoid_overwrite_important_env
15957 valatan   20   0  404960  35640  19016 R   2.7  0.9   0:04.41 lsphp:tan/domains/valatan.com/private_html/index.ph_room_to_avoid_overwrite_important_env
16462 sarvrang  20   0  289520  12476   7256 R   2.7  0.3   0:00.54 lsphp:/domains/sarvrangco.com/private_html/index.ph_room_to_avoid_overwrite_important_env

Connection counts:
      4 103.74.109.34
      4 117.111.4.39
      4 12.252.97.86
      4 14.226.38.106
      4 157.55.39.153
      4 170.238.180.2
      4 175.223.27.4
      4 177.10.202.107
      4 177.40.193.39
      4 182.52.52.163
      4 186.236.1.203
      4 187.58.135.42
      4 190.205.42.42
      4 190.220.1.173
      4 191.53.47.118
      4 204.10.182.34
      4 207.46.13.121
      4 31.59.2.134
      4 41.57.141.113
      4 43.228.112.98
      4 45.127.222.89
      4 45.167.80.2
      4 45.231.29.26
      4 49.128.184.76
      4 50.235.117.234
      4 50.246.120.125
      4 58.75.126.235
      4 72.195.114.184
      4 8.37.43.219
      4 98.103.88.147
      4 98.162.25.23
      4 98.162.96.52
      4 98.175.31.195
      5 113.161.70.165
      5 115.227.232.168
      5 117.251.195.85
      5 118.122.77.201
      5 14.207.81.4
      5 154.64.217.128
      5 157.55.39.234
      5 160.0.203.106
      5 170.247.202.20
      5 171.220.241.242
      5 173.195.27.130
      5 173.25.228.107
      5 177.143.128.37
      5 178.72.90.70
      5 186.39.100.193
      5 202.44.228.168
      5 205.177.85.130
      5 216.250.107.62
      5 222.252.48.241
      5 23.148.64.71
      5 24.214.238.54
      5 70.60.96.154
      5 74.62.55.193
      5 84.236.185.247
      5 91.238.55.86
      5 98.162.96.53
      6 103.144.170.22
      6 154.73.66.16
      6 64.27.10.3
      6 82.163.35.84
      6 92.38.184.241
      7 138.122.22.15
      7 183.89.192.38
      7 192.111.135.17
      7 31.15.89.51
      7 47.89.26.158
      7 72.221.196.157
      8 103.79.35.44
      8 68.71.249.153
      8 70.60.230.8
      8 92.38.171.51
      9 174.64.199.82
      9 192.252.215.5
      9 192.252.220.92
      9 218.82.112.227
      9 64.92.208.183
      9 67.201.33.9
     10 70.63.165.22
     11 72.210.252.137
     11 98.170.57.231
     12 72.49.49.11
     14 14.207.28.243
     14 91.243.81.245
     15 213.19.205.18
     15 216.215.126.106
     17 184.178.172.18
     17 70.166.167.36
     19 142.44.136.97
     19 184.181.217.210
     19 192.252.215.2
     20 8.40.133.10
     23 198.8.94.170
     25 184.179.216.130
     38 81.134.144.161
     47 213.186.33.99
     65 178.212.199.95
    278 127.0.0.1

IP '127.0.0.1' currently has '304' connections

Connection info for '127.0.0.1':
tcp        0      0 127.0.0.1:38786         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38700         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38854         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38764         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38682         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38852         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38914         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38942         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38818         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38656         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38954         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38726         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38686         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38946         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38806         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38804         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38636         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38950         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38990         127.0.0.1:3306          TIME_WAIT
tcp    11382      0 127.0.0.1:39014         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38874         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39052         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38808         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38502         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38706         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38882         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38684         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39104         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38928         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38812         127.0.0.1:3306          TIME_WAIT
tcp       88      0 127.0.0.1:39076         127.0.0.1:3306          ESTABLISHED
tcp       50      0 127.0.0.1:39078         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:39122         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38938         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38830         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38988         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38910         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39002         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38698         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38666         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38674         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38772         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38848         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38660         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39098         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38694         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39084         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38702         127.0.0.1:3306          TIME_WAIT
tcp      160      0 127.0.0.1:38862         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38966         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38844         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38890         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38478         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38758         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38658         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38960         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39040         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38734         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38746         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38840         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38766         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38738         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38884         127.0.0.1:3306          TIME_WAIT
tcp     2710      0 127.0.0.1:39118         127.0.0.1:3306          ESTABLISHED
tcp      207      0 127.0.0.1:39130         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38680         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38952         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39064         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:39086         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:39012         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38422         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39112         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38976         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38640         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38816         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39030         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38978         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38908         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39004         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38756         127.0.0.1:3306          TIME_WAIT
tcp       88      0 127.0.0.1:39134         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38744         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38634         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38810         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38730         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39018         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38948         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38644         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38712         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39058         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38654         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38900         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39108         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:39142         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38870         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39024         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38708         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38944         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39036         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38678         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38956         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38842         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39124         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38802         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39114         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38936         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39016         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38648         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38662         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38716         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38834         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38992         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38886         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39136         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38822         127.0.0.1:3306          TIME_WAIT
tcp      105      0 127.0.0.1:39044         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38800         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39090         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:39068         127.0.0.1:3306          ESTABLISHED
tcp    11368      0 127.0.0.1:39050         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:39080         127.0.0.1:3306          ESTABLISHED
tcp     2710      0 127.0.0.1:39120         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38652         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38880         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38792         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39106         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38768         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38918         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38826         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38868         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39034         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38980         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38760         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38598         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39000         127.0.0.1:3306          TIME_WAIT
tcp    32718      0 127.0.0.1:39128         127.0.0.1:3306          ESTABLISHED
tcp     2710      0 127.0.0.1:39100         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38858         127.0.0.1:3306          TIME_WAIT
tcp     4068      0 127.0.0.1:39126         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38860         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38714         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38996         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38778         127.0.0.1:3306          TIME_WAIT
tcp        0    714 127.0.0.1:39026         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38704         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39020         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39046         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38728         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39070         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38872         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38796         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38836         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38688         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38752         127.0.0.1:3306          TIME_WAIT
tcp      110      0 127.0.0.1:39074         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38912         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38790         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38724         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38736         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38770         127.0.0.1:3306          TIME_WAIT
tcp       88      0 127.0.0.1:39102         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38878         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38762         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39010         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38664         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38696         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38926         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38970         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38670         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38720         127.0.0.1:3306          TIME_WAIT
tcp      160      0 127.0.0.1:38924         127.0.0.1:3306          ESTABLISHED
tcp      810      0 127.0.0.1:39144         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38934         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39008         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38750         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38692         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38782         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38776         127.0.0.1:3306          TIME_WAIT
tcp        0    525 127.0.0.1:39022         127.0.0.1:3306          ESTABLISHED
tcp      108      0 127.0.0.1:39062         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38718         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38410         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38974         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38888         127.0.0.1:3306          TIME_WAIT
tcp      104      0 127.0.0.1:38922         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38894         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38940         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39006         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38982         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38828         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38784         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38998         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38732         127.0.0.1:3306          TIME_WAIT
tcp       88      0 127.0.0.1:39054         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38628         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38964         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38962         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38690         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39110         127.0.0.1:3306          ESTABLISHED
tcp     4068      0 127.0.0.1:39140         127.0.0.1:3306          ESTABLISHED
tcp     1387      0 127.0.0.1:39056         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38814         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38676         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38932         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39082         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38916         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38846         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38722         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38906         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39028         127.0.0.1:3306          TIME_WAIT
tcp     4068      0 127.0.0.1:39138         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38866         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39132         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38902         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38994         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38638         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38774         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39094         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38794         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38958         127.0.0.1:3306          TIME_WAIT
tcp      752      0 127.0.0.1:39116         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38832         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38710         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39038         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38742         127.0.0.1:3306          TIME_WAIT
tcp      999      0 127.0.0.1:39048         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38850         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38754         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38798         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38672         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38650         127.0.0.1:3306          TIME_WAIT
tcp      855      0 127.0.0.1:39072         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38780         127.0.0.1:3306          TIME_WAIT
tcp       88      0 127.0.0.1:39060         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38876         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38740         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38838         127.0.0.1:3306          TIME_WAIT
tcp       88      0 127.0.0.1:39032         127.0.0.1:3306          ESTABLISHED
tcp       88      0 127.0.0.1:39066         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38668         127.0.0.1:3306          TIME_WAIT
tcp      495      0 127.0.0.1:38896         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38748         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38904         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38824         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38592         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39096         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38620         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38986         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38968         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38864         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39088         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38856         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38626         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:39092         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:38984         127.0.0.1:3306          TIME_WAIT
tcp        0      0 127.0.0.1:38972         127.0.0.1:3306          TIME_WAIT
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39134         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39130         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39014         TIME_WAIT
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39138         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39084         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:38904         TIME_WAIT
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39076         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39102         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39070         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39034         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:38820         TIME_WAIT
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39038         ESTABLISHED
tcp6       0  11368 127.0.0.1:3306          127.0.0.1:39052         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39112         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:38924         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39012         ESTABLISHED
tcp6    1484      0 127.0.0.1:3306          127.0.0.1:38974         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39026         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39050         ESTABLISHED
tcp6       0     88 127.0.0.1:3306          127.0.0.1:39086         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39062         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39114         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39058         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39044         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39094         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:38918         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39080         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39040         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39100         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39090         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39116         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39046         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39104         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39048         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39088         ESTABLISHED
tcp6     207      0 127.0.0.1:3306          127.0.0.1:39022         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39148         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39108         ESTABLISHED
tcp6       0   4068 127.0.0.1:3306          127.0.0.1:39128         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39096         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:38896         ESTABLISHED
tcp6       0    105 127.0.0.1:3306          127.0.0.1:39068         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39118         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39126         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39146         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:38922         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:38930         TIME_WAIT
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39140         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39110         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39010         ESTABLISHED
tcp6       0   1381 127.0.0.1:3306          127.0.0.1:39072         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39092         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39064         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39078         ESTABLISHED
tcp6       0     50 127.0.0.1:3306          127.0.0.1:39054         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39132         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:38898         TIME_WAIT
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39122         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39106         ESTABLISHED
tcp6       0    105 127.0.0.1:3306          127.0.0.1:39032         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:38788         TIME_WAIT
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39030         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39144         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39082         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39142         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39124         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39074         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39098         ESTABLISHED
tcp6     544      0 127.0.0.1:3306          127.0.0.1:39036         ESTABLISHED
tcp6       0     88 127.0.0.1:3306          127.0.0.1:39056         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39136         ESTABLISHED
tcp6       0     50 127.0.0.1:3306          127.0.0.1:39060         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:39120         ESTABLISHED
tcp6       0     88 127.0.0.1:3306          127.0.0.1:39066         ESTABLISHED
tcp6       0      0 127.0.0.1:3306          127.0.0.1:38862         ESTABLISHED

also my access log increased

Code:

175.223.2.133 - - [31/Jan/2022:09:22:59 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
39.7.15.88 - - [31/Jan/2022:09:23:04 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2942.99 Safari/537.36"
123.231.141.58 - - [31/Jan/2022:09:23:04 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
123.231.141.58 - - [31/Jan/2022:09:23:05 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2725.53 Safari/537.36"
123.231.141.58 - - [31/Jan/2022:09:23:05 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2725.53 Safari/537.36"
80.253.187.172 - - [31/Jan/2022:09:23:06 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (X11; Linux i686 on x86_64; rv:48.0) Gecko/20100101 Firefox/48.0"
39.7.15.88 - - [31/Jan/2022:09:23:08 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2942.99 Safari/537.36"
170.106.152.12 - - [31/Jan/2022:09:23:09 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0"
123.231.141.58 - - [31/Jan/2022:09:23:10 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
39.7.15.88 - - [31/Jan/2022:09:23:10 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
39.7.15.88 - - [31/Jan/2022:09:23:11 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
175.223.2.133 - - [31/Jan/2022:09:23:12 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
123.231.141.58 - - [31/Jan/2022:09:23:17 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2725.53 Safari/537.36"
175.223.2.133 - - [31/Jan/2022:09:23:20 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
223.38.61.229 - - [31/Jan/2022:09:23:20 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
123.231.141.58 - - [31/Jan/2022:09:23:22 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
175.223.2.133 - - [31/Jan/2022:09:23:24 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2881.1 Safari/537.36"
39.7.15.88 - - [31/Jan/2022:09:23:24 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
103.192.227.155 - - [31/Jan/2022:09:23:25 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
175.223.2.133 - - [31/Jan/2022:09:23:27 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2881.1 Safari/537.36"
123.231.141.58 - - [31/Jan/2022:09:23:28 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
209.146.44.194 - - [31/Jan/2022:09:23:28 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
110.70.55.79 - - [31/Jan/2022:09:23:28 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
177.37.176.78 - - [31/Jan/2022:09:23:30 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
39.7.15.88 - - [31/Jan/2022:09:23:33 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2942.99 Safari/537.36"
175.223.2.133 - - [31/Jan/2022:09:23:33 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
123.231.141.58 - - [31/Jan/2022:09:23:34 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
110.70.55.79 - - [31/Jan/2022:09:23:37 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2658.60 Safari/537.36"
110.70.55.79 - - [31/Jan/2022:09:23:38 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2658.60 Safari/537.36"
81.12.33.174 - - [31/Jan/2022:09:23:38 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
175.223.2.133 - - [31/Jan/2022:09:23:41 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
39.7.15.88 - - [31/Jan/2022:09:23:48 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
110.70.55.79 - - [31/Jan/2022:09:23:50 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
39.7.15.88 - - [31/Jan/2022:09:23:50 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
39.7.15.88 - - [31/Jan/2022:09:23:54 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2942.99 Safari/537.36"
80.253.187.172 - - [31/Jan/2022:09:23:55 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (X11; Linux i686 on x86_64; rv:48.0) Gecko/20100101 Firefox/48.0"
183.89.177.171 - - [31/Jan/2022:09:23:57 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
110.70.55.79 - - [31/Jan/2022:09:23:58 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
39.7.15.88 - - [31/Jan/2022:09:23:58 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2942.99 Safari/537.36"
80.253.187.172 - - [31/Jan/2022:09:24:00 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (X11; Linux i686 on x86_64; rv:48.0) Gecko/20100101 Firefox/48.0"
39.7.15.88 - - [31/Jan/2022:09:24:02 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2942.99 Safari/537.36"
185.206.175.179 - - [31/Jan/2022:09:24:02 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2685.77 Safari/537.36"
39.7.15.88 - - [31/Jan/2022:09:24:03 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
175.223.2.133 - - [31/Jan/2022:09:24:04 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
39.7.15.88 - - [31/Jan/2022:09:24:06 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
175.223.2.133 - - [31/Jan/2022:09:24:06 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
103.192.227.155 - - [31/Jan/2022:09:24:08 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64; rv:46.0) Gecko/20100101 Firefox/46.0"
123.231.141.58 - - [31/Jan/2022:09:24:13 +0000] "GET / HTTP/1.1" 200 0 "-" "-"
95.38.192.129 - - [31/Jan/2022:09:24:33 +0000] "GET / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1; Win64; x64; Trident/5.0)"
81.12.33.174 - - [31/Jan/2022:09:25:00 +0000] "GET / HTTP/1.1" 200 0 "-" "-"

anyone could help me about this?

Zhenyapan · Jan 31, 2022

just block this few bots IPs

mikajaxxx · Jan 31, 2022

i blocked them but attacks come up from new ips every day

cjd · Jan 31, 2022

Logs show your using swap, so your ran out of ram from too many php/sql requests that didn't finish in time. As soon as things start swapping things go down fast. Best to add more ram to handle more load. Also could look at what site/pages are causing the problem and optimize them. Maybe also use a CDN like Cloud-flare to help cache/mitigate the issue.

mikajaxxx · Jan 31, 2022

cjd said:
Logs show your using swap, so your ran out of ram from too many php/sql requests that didn't finish in time. As soon as things start swapping things go down fast. Best to add more ram to handle more load. Also could look at what site/pages are causing the problem and optimize them. Maybe also use a CDN like Cloud-flare to help cache/mitigate the issue.

I believe my main problem is because of attacks/bots. my server cpu normaly run under 0.4 so the problem could not be because of ram or server but when i transfer specific website to my server all these happens to server but i could not determine which script ot that website cause this problem. where i could find the script /file cause such attacks?

cjd · Jan 31, 2022

What's your free memory when everything is running well, when the server has been running for a while?

Zhenyapan · Jan 31, 2022

mikajaxxx said:
where i could find the script /file cause such attacks?

check apache/nginx logs. easiest way to sort them by size - so you will find which grows faster, then check it. also you can try set limit rate from nginx side for this problem domain.

mikajaxxx · Feb 1, 2022

cjd said:
What's your free memory when everything is running well, when the server has been running for a while?

it is listed in log file i attached
KiB Mem : 3781860 total, 122896 free, 2910004 used, 748960 buff/cache

also as i said it seems the main problem is about specifict website i need to know what script caused this

mikajaxxx · Feb 1, 2022

Zhenyapan said:
check apache/nginx logs. easiest way to sort them by size - so you will find which grows faster, then check it. also you can try set limit rate from nginx side for this problem domain.

I am using openlitespeed ! how i can do that?

Zhenyapan · Feb 1, 2022

Welcome | OpenLiteSpeed Documentation | OpenLiteSpeed Documentation

Documentation for OpenLiteSpeed

openlitespeed.org

check here.

mikajaxxx · Feb 4, 2022

ok the reason of the problem completely related to a domain
i transferred that domain from server A( high cpu problem ) to server B
server A cpu load from 70 goes to around 0.2 ! also the access log completely gone! i have no access log after a 2 days.
Now server B have the same problem and cpu load goes to 40 ! it seems the problem is because of the domain. when i change nameserver of that domain to any server , the server begin showing wiered high cpu usage and alot of attacks on port 80 from all around the world!
Is that possible the domain name guide attacks on the server? or there is an script on that website cause this? how i can check this?
i need a guide to determine where is the problem? anyone could help ?

Zhenyapan · Feb 4, 2022

put this domain behind cloudflare and use their filters

gozen · Feb 4, 2022

This is where solutions like CloudLinux help where they can limit the resources one domain/account is using.

mikajaxxx · Feb 7, 2022

Zhenyapan said:
put this domain behind cloudflare and use their filters

I tried that but didn't helped. also the attacks goes on other websites too! wiered situation when i host that specific website all my other websites share that ip have strange http requests! i think there is an script on that website which lead those ddos attacks but i can't find that script! any advice to find the script?

Zhenyapan · Feb 7, 2022

let website owner move it to another hoster

or limit requests by country

MYSQL high CPU usage

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Attachments

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User