Solved

Wordpress site spawning many php-cgi.exe processes with no site traffic

Posted on 2014-09-27
4
1,697 Views
Last Modified: 2014-10-03
Here's the scenario:

I have three (3) separate WP websites running on a 64-bit Win 2008 R2 Server. All sites are setup identically using:
- FastCGI
- InstanceMaxRequests = 10000
- PHP_FCGI_MAX_REQUESTS =10000
- Separate app pools (integrated)
- All app pools identical in settings

While testing for the last few hours all sites has close to zero traffic...but...when I look at the process manager I find this:

Site #1 - one php-cgi.exe process running
Site #2 - dozens of php-cgi.exe processes running (always up to the Max Instances value)
Site #3 - dozens of php-cgi.exe processes running (always up to the Max Instances value)

Many of the processes are at zero cpu usage but are hogging memory.

The strange thing is that no matter what I do on site #1 (connecting with multiple browsers etc.) the site uses just one or two processes, and shuts them down pretty efficiently when done.

On sites #2 and #3 I can stop the app pool, make sure all processes are gone, then within a few seconds of restarting the app pool they have once again spawned the maximum number of php-cgi.exe processes (depending on what I have set as the Max Instances - I've tried it with many values from 0 to 50, and the results never vary). BTW, when I have Max Instances set to 0, sites 2 & 3 will spawn enough processes to spike the CPU at 100%.

Here's what I have tried, with no luck:

- Updating WP and all Pluings to most current versions
- Deactivating all plugins entirely
- Changing theme to a fresh WP 2014 theme
- Installing WordFence and blocking any IP ranges outside the USA (although there was only two hits from those the entire evening).
- Scanning with WordFence to find any security flaws (it came up with a clean bill of health)

So, what am I missing here?  Where do I look to figure out why one site runs beautifully and the other two act up?
0
Comment
Question by:worthyking1
  • 3
4 Comments
 
LVL 70

Expert Comment

by:Jason C. Levine
Comment Utility
Are you logged into the WordPress Dashboard when these processes spawn?
0
 
LVL 6

Author Comment

by:worthyking1
Comment Utility
It makes no difference. They spin up regardless of whether I am logged into the WP dashboard or not.
0
 
LVL 6

Accepted Solution

by:
worthyking1 earned 0 total points
Comment Utility
Okay, i solved it. After digging through the server logs I discovered that the source of the problem was an attack on the xmlrpc.php file.  I know that (according to WP) there is no security issue any longer with this but it seems some idiot hackers still like to keep banging on it trying to get something to happen.

The two sites in question both had non-stop traffic coming primarily for the Ecatel Ltd. network in the Netherlands and one or two other random IPs from France, si I simply blocked those IP ranges using the Windows Firewall as I don't want this traffic to even reach as far as IIS.

Logs are back to being real small and CPU is normal. WP is spawning php-cgi.exe processes only as needed and recycling them normally.

Here's a decent thread describing the same issue (although with Linux solutions rather than Win 2008):
https://wordpress.org/support/topic/xmlrpcphp-attack-on-wordpress-38
0
 
LVL 6

Author Closing Comment

by:worthyking1
Comment Utility
Being that there were no solutions provided by the membership I had to keep cracking until I solved it myself.  truthfully, I should have looked at my logs right at the beginning but the WP angle threw me off my normal game.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

If you are looking for plug-ins to add functions to your WordPress small business web site, take some time to read though this comprehensive list.  These are all the plugins I use for my customers WordPress web sites, as well as my own.  Be sure to …
So you have coded your own WordPress plugin and now you want to allow users to upload images to a folder in the plugin folder rather than the default media location? Follow along and this article will show you how to do just that!
The purpose of this video is to demonstrate how to manually back up a WordPress Database. This will be demonstrated using a Windows 8 PC. The Host used will be IPage.com Log into your Hosting account. IPage will be used for demonstration : Locat…
This video teaches viewers how to create their own website using cPanel and Wordpress. Tutorial walks users through how to set up their own domain name from tools like Domain Registrar, Hosting Account, and Wordpress. More specifically, the order in…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now