Question Random CPU spikes php-fpm

[frizzerbv]

Server operating system version

Plesk Obisidian v18.0.47 os_CentOS 7

Plesk version and microupdate number

Plesk Obisidian v18.0.47 os_CentOS 7

Hello,

We are a marketing agency from the Netherlands and we are using a VPS running Plesk Obisidian v18.0.47 os_CentOS 7. Since last week we are recieving a lot of spikes in the CPU ussage of the VPS. We are using the VPS to host the websites of our clients. Some are websites some are webshops. We are not getting 10.000 visits daily or weekly in total. Sometimes monthly 10.000 and we are currently hosting 28 websites and webshops on a 8 dedicated cores VPS with 16GB ram.

The command that is causing the spikes is php-fpm. And we think it has something to do with Mooieschoenen.nl. In the logs some random ip's are getting images from the website. We have no idea were that is coming from. We disabled all plugins etc and its stil happening. When we search Ipinfo the IP is coming from Microsoft.

I have added some screenshots of the CPU ussage. These are all 1-5 seconds apart of eachother. We dont know if it is normal to use that kind of CPU ussage so maybe someone can tell us.

Greetings,
Niels Koelewijn

 

[Bitpalast]

Likely a bad bot visiting your site. Check your access_log and error_log files for the browser ID that it is using, then try to block them in an .htaccess file for starters and maybe later add it to a suitable fail2ban rule. Example for .htaccess block:

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} (PetalBot|UptimeRobot|seocompany|LieBaoFast|SEOkicks|Uptimebot|Cliqzbot|ssearch_bot|domaincrawler|AhrefsBot|spot|DigExt|Sogou|MegaIndex.ru|majestic12|80legs|SISTRIX|HTTrack|Semrush|MJ12|MJ12bot|MJ12Bot|Ezooms|CCBot|TalkTalk|Ahrefs|BLEXBot) [NC] 
RewriteRule .* - [F]