PHP-FPM7 problem with memory

[Mattpl]

I have a problem with php-fpm v.7, after all the night the service can even up and 9GB of memory, it helps reload each morning. This version runs only Wordpress. Will the restriction on the memory access service help in this case?

It seems that the service is overloaded only at the time of my manual reload, the memory usage is ok until late. Something needs to happen after a system overload

[17-Nov-2017 00:12:01] NOTICE: Reloading in progress ...
[17-Nov-2017 00:12:01] NOTICE: reloading: execvp("/usr/local/php70/sbin/php-fpm70", {"/usr/local/php70/sbin/php-fpm70", "--nodaemonize"})
[17-Nov-2017 00:12:01] NOTICE: using inherited socket fd=7, "/usr/local/php70/sockets/webapps.sock"
[17-Nov-2017 00:12:01] NOTICE: using inherited socket fd=7, "/usr/local/php70/sockets/webapps.sock"
[17-Nov-2017 00:12:01] NOTICE: using inherited socket fd=8, "/usr/local/php70/sockets/admin.sock"
[17-Nov-2017 00:12:01] NOTICE: using inherited socket fd=8, "/usr/local/php70/sockets/admin.sock"
[17-Nov-2017 00:12:01] NOTICE: using inherited socket fd=9, "/usr/local/php70/sockets/systemrek.sock"
[17-Nov-2017 00:12:01] NOTICE: using inherited socket fd=9, "/usr/local/php70/sockets/systemrek.sock"
[17-Nov-2017 00:12:01] NOTICE: using inherited socket fd=10, "/usr/local/php70/sockets/szukamprac.sock"
[17-Nov-2017 00:12:01] NOTICE: using inherited socket fd=10, "/usr/local/php70/sockets/szukamprac.sock"
[17-Nov-2017 00:12:01] NOTICE: using inherited socket fd=11, "/usr/local/php70/sockets/test2.sock"
[17-Nov-2017 00:12:01] NOTICE: using inherited socket fd=11, "/usr/local/php70/sockets/test2.sock"
[17-Nov-2017 00:12:01] NOTICE: fpm is running, pid 7599
[17-Nov-2017 00:12:01] NOTICE: ready to handle connections
[17-Nov-2017 00:12:01] NOTICE: systemd monitor interval set to 10000ms

system.log

2017:11:17-00:12:01: php-fpm56 reloaded
2017:11:17-00:12:01: php-fpm70 reloaded

 

[zEitEr]

Hello,

Check apache logs and server status. It might be that either your WP sites are under a bruteforce/spam attack or you have malware on a board.

To stop bruteforce you are suggested to use brute-force monitor in Directadmin:

- https://help.directadmin.com/item.php?id=404
- https://help.directadmin.com/item.php?id=527

To detect malware use maldet:

- http://forum.directadmin.com/showthread.php?t=45851

 

[Mattpl]

Hi! Brutforce monitor is always on comodo WAF also on. Now I'm also turn on wordpress brutforce

Apache error log for this domain

[Fri Nov 17 08:01:54.631526 2017] [proxy_fcgi:error] [pid 22745:tid 140107294058240] [client 193.107.88.114:41533] AH01067: Failed to read FastCGI header
[Fri Nov 17 08:01:54.631560 2017] [proxy_fcgi:error] [pid 22745:tid 140107294058240] (104)Connection reset by peer: [client 193.107.88.114:41533] AH01075: Error dispatching request to :
[Fri Nov 17 08:01:54.637233 2017] [proxy_fcgi:error] [pid 22745:tid 140107294058240] [client 193.107.88.114:41533] AH01067: Failed to read FastCGI header
[Fri Nov 17 08:01:54.637247 2017] [proxy_fcgi:error] [pid 22745:tid 140107294058240] (104)Connection reset by peer: [client 193.107.88.114:41533] AH01075: Error dispatching request to :
[Fri Nov 17 08:01:54.695663 2017] [proxy:error] [pid 22691:tid 140107151382272] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /usr/local/php70/sockets/szukamprac.sock (*) failed
[Fri Nov 17 08:01:54.695689 2017] [proxy_fcgi:error] [pid 22691:tid 140107151382272] [client 193.107.88.114:41534] AH01079: failed to make connection to backend: httpd-UDS
[Fri Nov 17 08:01:54.695817 2017] [proxy:error] [pid 22691:tid 140107151382272] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /usr/local/php70/sockets/szukamprac.sock (*) failed
[Fri Nov 17 08:01:54.695828 2017] [proxy_fcgi:error] [pid 22691:tid 140107151382272] [client 193.107.88.114:41534] AH01079: failed to make connection to backend: httpd-UDS
[Fri Nov 17 08:40:57.839617 2017] [proxy:error] [pid 25775:tid 140107277272832] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /usr/local/php70/sockets/szukamprac.sock (*) failed
[Fri Nov 17 08:40:57.839640 2017] [proxy_fcgi:error] [pid 25775:tid 140107277272832] [client 193.107.88.114:53098] AH01079: failed to make connection to backend: httpd-UDS
[Fri Nov 17 08:40:57.839728 2017] [proxy:error] [pid 25775:tid 140107277272832] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /usr/local/php70/sockets/szukamprac.sock (*) failed
[Fri Nov 17 08:40:57.839736 2017] [proxy_fcgi:error] [pid 25775:tid 140107277272832] [client 193.107.88.114:53098] AH01079: failed to make connection to backend: httpd-UDS
[Fri Nov 17 15:35:51.018430 2017] [proxy_fcgi:error] [pid 29103:tid 140107403163392] [client 193.107.88.114:37296] AH01067: Failed to read FastCGI header
[Fri Nov 17 15:35:51.018452 2017] [proxy_fcgi:error] [pid 29103:tid 140107403163392] (104)Connection reset by peer: [client 193.107.88.114:37296] AH01075: Error dispatching request to :
[Fri Nov 17 15:35:51.018695 2017] [proxy:error] [pid 29103:tid 140107403163392] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /usr/local/php70/sockets/szukamprac.sock (*) failed
[Fri Nov 17 15:35:51.018704 2017] [proxy_fcgi:error] [pid 29103:tid 140107403163392] [client 193.107.88.114:37296] AH01079: failed to make connection to backend: httpd-UDS

 

[zEitEr]

you should check you domain specific logs and find repeating POST queries, and other anomalies.

 

[Mattpl]

Yesterday I have turn on this option for Wordpress brutfoce attack and today evertyhing looks alright.