Question Unknown traffic/CPU/disk spike once every hour

[iratefox]

Hi everyone,

We've been using Plesk for about 5 months now and in the last 3/4 weeks our server has started experiencing a regular spike in CPU, Disk write, and inbound traffic. It's not causing any problems as such but we've not been able to attribute the sudden regularity with any deployments or changes we've made and it just seems rather strange and I wanted to try and find the source.

CPU jumps an additional 10-15% from wherever it was for about 5-10 minutes, there's an additional 200kb/s inbound, and disk write 400kb/s for the same duration. It happens every single hour, approximately 5 minutes past each hour. This can sometimes vary a minute or two in start time, but it seems fairly consistent.

I've checked every website logs and cannot see any traffic hitting any of the sites in this time (a lot of our sites are static and are 99% cached at Cloudflare). I've also checked processes running on the machine and there's nothing out of the ordinary at all, nothing seems to introduce this sort of processing - only once I saw a mysql process jump 8% but it didn't last more than a few seconds and everything was back to normal which didn't align with the server stats we can see. I've also been keeping an eye on the Plesk process view and again everything seems ordinary.

Does anyone have any advice on trying to pin down where this is coming from please? Is this maybe even Plesk related following an update?

Thanks

 

[Bitpalast]

our server has started experiencing a regular spike in ...inbound traffic.

There you go.

 

[iratefox]

I appreciate that, but I’m unable to so far locate anything that would be causing this. My hope was that we’d find out it’s a service somewhere with a silly polling/update process that we could tweak. As stated, each site’s logs don’t have anything to indicate they are the target. So my general question is whether anybody has any other ideas to trace where this may be targeting specifically, or whether a Plesk service may be causing this? I’m assuming it’s service related rather than anything else due to the almost exact timing, duration, and regularity of this spike.

 

[pleskpanel]

If it's that regular, try first to check for a pattern -

When the activity occurs, run this command several times to identify the top external connections with open connections:

netstat -nt | awk '/^tcp/ {print $5}' | awk -F: '{print $1}' | sort | uniq -c | sort -n

Are you certainly that it's external traffic and not a website-based cron job of some sort?

 

[iratefox]

If it's that regular, try first to check for a pattern -

When the activity occurs, run this command several times to identify the top external connections with open connections:

netstat -nt | awk '/^tcp/ {print $5}' | awk -F: '{print $1}' | sort | uniq -c | sort -n

Are you certainly that it's external traffic and not a website-based cron job of some sort?

Thank you - I shall try this shortly. Cron jobs were my first thought and quickly ruled those out.

Thanks

 

[pleskpanel]

Thank you - I shall try this shortly. Cron jobs were my first thought and quickly ruled those out.

Thanks

Not a system cron utility but a software/CMS-initiated "poor man's" cron (i.e. a regularly scheduled WordPress task initiated by the CMS itself).