One user at 99.6% cpu for httpd process. How to figure out what is going on?

jim.thornton

Verified User
Joined
Jan 1, 2008
Messages
334
I have a user on my server that uses Wordpress. I was in the admin panel for him and it is REALLY slow. This got me looking into reasons. One article suggested that my resources were being taxed. That shouldn't be the case since this server is more powerful than I need.

I ran top and found that this user is at 99.6% cpu usage with 4.6% MEM usage. No other processes are even using anything elevated.

Can someone help me figure out what is going on?

I don't know how to debug this any further and would appreciate some help here.
 
Hello,

Is mod_php used? Then there might be numerous reasons of the issue:

1. brute-force attack on WP
2. spam bot attack on WP
3. xmlrpc.php attack on WP
4. wp-cron trying to complete a task which fails
5. feeds and other requests to remote ports which are not available for different reasons (closed ports, not responging domains, connectivity issues).
6. broken mysql tables
6. misc.

server-status, strace, tcpdump, mysqlcheck, logs... there is no simple way to debug it.
 
I have a user on my server that uses Wordpress. I was in the admin panel for him and it is REALLY slow. This got me looking into reasons. One article suggested that my resources were being taxed. That shouldn't be the case since this server is more powerful than I need.

Hi,

Does the user have W3TC installed? In that case you could try to disable the object cache. That causes a slow admin area quite often.

You could also install the WP Query Monitor plugin for some debugging. Maybe on of the other plugins used is causing the issue.
 
Hi,

Does the user have W3TC installed? In that case you could try to disable the object cache. That causes a slow admin area quite often.

You could also install the WP Query Monitor plugin for some debugging. Maybe on of the other plugins used is causing the issue.

No there is no W3TC plugin installed.
 
Don't you have CSF/LFD installed? There is a possibility this can tell you which process and/or which user is eating up the resources.
My guess it's what Zeiter said as possible cause 3.
 
CSF/LFD normally automatically sends a message if some process is eating up resources memory or cpu.

There are several ways to fix issue 3. One is to just delete the xmlrpcphp file or block access with .htaccess file.
There are also some wordpress addons which the user can use.
 
Back
Top