Issue 100% CPU Usage

[Ash95]

Server operating system version

Ubuntu 18.04

Plesk version and microupdate number

Version 18.0.43 Update #1

getting 5** error on my site checked hardware useage and CPU is at 100% but only the last two days other then that was less the 10% usage and advice pls

nothing has been changed on the vps or website files in like 2 weeks

also sometimes i get this when i click on restart or start in PHP settings

 

[Ash95]

ran this command "ps aux" and getting this

 

[Bitpalast]

Look into /var/www/vhosts/<subscription of the user you see in the first column>/logs and check access_ssl_log and error_log contents. Normally you'll find lots of bad bot requests there or POSTs coming from the same IP address. Block that address (unless it is your own):
# fail2ban-client set recidive banip <IP-address>

 

[Ash95]

Look into /var/www/vhosts/<subscription of the user you see in the first column>/logs and check access_ssl_log and error_log contents. Normally you'll find lots of bad bot requests there or POSTs coming from the same IP address. Block that address (unless it is your own):
# fail2ban-client set recidive banip <IP-address>

[Thu May 05 09:13:50.376872 2022] [proxy_fcgi:error] [pid 24486:tid 140180509894400] (104)Connection reset by peer: [client 2a02:c206:2048:5042::1:50858] AH01075: Error dispatching request to :
[Thu May 05 09:13:50.404165 2022] [proxy_fcgi:error] [pid 24475:tid 140180577036032] [client 91.224.104.206:47414] AH01067: Failed to read FastCGI header
[Thu May 05 09:13:50.404271 2022] [proxy_fcgi:error] [pid 24475:tid 140180577036032] (104)Connection reset by peer: [client 91.224.104.206:47414] AH01075: Error dispatching request to :
[Thu May 05 09:13:50.405640 2022] [proxy:error] [pid 24396:tid 140180744824576] (111)Connection refused: AH02454: FCGI: attempt to connect to Unix domain socket /var/www/vhosts/system/***********/php-fpm.sock (*) failed
[Thu May 05 09:13:50.405714 2022] [proxy_fcgi:error] [pid 24396:tid 140180744824576] [client 64.202.185.228:47674] AH01079: failed to make connection to backend: httpd-UDS
[Thu May 05 09:13:50.405973 2022] [proxy:error] [pid 24290:tid 140180728039168] (111)Connection refused: AH02454: FCGI: attempt to connect to Unix domain socket /var/www/vhosts/system/***********/php-fpm.sock (*) failed
[Thu May 05 09:13:50.406120 2022] [proxy_fcgi:error] [pid 24290:tid 140180728039168] [client 148.202.167.75:47644] AH01079: failed to make connection to backend: httpd-UDS
[Thu May 05 09:13:50.407432 2022] [proxy:error] [pid 24290:tid 140179981416192] (111)Connection refused: AH02454: FCGI: attempt to connect to Unix domain socket /var/www/vhosts/system/***********/php-fpm.sock (*) failed
[Thu May 05 09:13:50.407484 2022] [proxy_fcgi:error] [pid 24290:tid 140179981416192] [client 91.238.164.173:47746] AH01079: failed to make connection to backend: httpd-UDS
[Thu May 05 09:13:50.407530 2022] [proxy:error] [pid 24485:tid 140180593821440] (111)Connection refused: AH02454: FCGI: attempt to connect to Unix domain socket /var/www/vhosts/system/***********/php-fpm.sock (*) failed
[Thu May 05 09:13:50.407561 2022] [proxy_fcgi:error] [pid 24485:tid 140180593821440] [client 115.166.150.132:47404] AH01079: failed to make connection to backend: httpd-UDS

this is in error log from the day it happened and this is all i get in error_log just spamming this over and over

 

[Bitpalast]

The failed connections to the socket can be a result from excessive load / number of requests against the server. Check access_ssl_log and carefully consider what the request the website is getting are doing. Are they from bad bots? Then block these bots, e.g. by an entry in your .htaccess file like

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} (seocompany|LieBaoFast|SEOkicks|Uptimebot|Cliqzbot|ssearch_bot|domaincrawler|AhrefsBot|spot|DigExt|Sogou|MegaIndex.ru|majestic12|80legs|SISTRIX|HTTrack|Semrush|MJ12|MJ12bot|MJ12Bot|Ezooms|CCBot|TalkTalk|Ahrefs|BLEXBot) [NC]
RewriteRule .* - [F]

You can also try to increase the number of concurrent FastCGI connections allowed, e.g edit /etc/httpd/conf.d/fcgid.conf and update these lines:

FcgidMaxProcesses <new high number, e.g. 400>
FcgidMaxProcessesPerClass <new high number, e.g. 30>

If you are not yet using PHP-FPM I'd also try switching to that with a higher number of max_children (e.g. not 5 as the default, but maybe 20).

Also consider, as mentioned before, to block IP addresses that are constantly trying to GET or POST against your server.