Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Wordpress site spawning many php-cgi.exe processes with no site traffic

Posted on 2014-09-27
4
Medium Priority
?
2,893 Views
Last Modified: 2014-10-03
Here's the scenario:

I have three (3) separate WP websites running on a 64-bit Win 2008 R2 Server. All sites are setup identically using:
- FastCGI
- InstanceMaxRequests = 10000
- PHP_FCGI_MAX_REQUESTS =10000
- Separate app pools (integrated)
- All app pools identical in settings

While testing for the last few hours all sites has close to zero traffic...but...when I look at the process manager I find this:

Site #1 - one php-cgi.exe process running
Site #2 - dozens of php-cgi.exe processes running (always up to the Max Instances value)
Site #3 - dozens of php-cgi.exe processes running (always up to the Max Instances value)

Many of the processes are at zero cpu usage but are hogging memory.

The strange thing is that no matter what I do on site #1 (connecting with multiple browsers etc.) the site uses just one or two processes, and shuts them down pretty efficiently when done.

On sites #2 and #3 I can stop the app pool, make sure all processes are gone, then within a few seconds of restarting the app pool they have once again spawned the maximum number of php-cgi.exe processes (depending on what I have set as the Max Instances - I've tried it with many values from 0 to 50, and the results never vary). BTW, when I have Max Instances set to 0, sites 2 & 3 will spawn enough processes to spike the CPU at 100%.

Here's what I have tried, with no luck:

- Updating WP and all Pluings to most current versions
- Deactivating all plugins entirely
- Changing theme to a fresh WP 2014 theme
- Installing WordFence and blocking any IP ranges outside the USA (although there was only two hits from those the entire evening).
- Scanning with WordFence to find any security flaws (it came up with a clean bill of health)

So, what am I missing here?  Where do I look to figure out why one site runs beautifully and the other two act up?
0
Comment
Question by:worthyking1
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
4 Comments
 
LVL 70

Expert Comment

by:Jason C. Levine
ID: 40348205
Are you logged into the WordPress Dashboard when these processes spawn?
0
 
LVL 6

Author Comment

by:worthyking1
ID: 40348786
It makes no difference. They spin up regardless of whether I am logged into the WP dashboard or not.
0
 
LVL 6

Accepted Solution

by:
worthyking1 earned 0 total points
ID: 40348852
Okay, i solved it. After digging through the server logs I discovered that the source of the problem was an attack on the xmlrpc.php file.  I know that (according to WP) there is no security issue any longer with this but it seems some idiot hackers still like to keep banging on it trying to get something to happen.

The two sites in question both had non-stop traffic coming primarily for the Ecatel Ltd. network in the Netherlands and one or two other random IPs from France, si I simply blocked those IP ranges using the Windows Firewall as I don't want this traffic to even reach as far as IIS.

Logs are back to being real small and CPU is normal. WP is spawning php-cgi.exe processes only as needed and recycling them normally.

Here's a decent thread describing the same issue (although with Linux solutions rather than Win 2008):
https://wordpress.org/support/topic/xmlrpcphp-attack-on-wordpress-38
0
 
LVL 6

Author Closing Comment

by:worthyking1
ID: 40358955
Being that there were no solutions provided by the membership I had to keep cracking until I solved it myself.  truthfully, I should have looked at my logs right at the beginning but the WP angle threw me off my normal game.
0

Featured Post

Moving data to the cloud? Find out if you’re ready

Before moving to the cloud, it is important to carefully define your db needs, plan for the migration & understand prod. environment. This wp explains how to define what you need from a cloud provider, plan for the migration & what putting a cloud solution into practice entails.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are a web developer, you would be aware of the <iframe> tag in HTML. The <iframe> stands for inline frame and is used to embed another document within the current HTML document. The embedded document could be even another website.
As tax season makes its return, so does the increase in cyber crime and tax refund phishing that comes with it
This video teaches users how to migrate an existing Wordpress website to a new domain.
The purpose of this video is to demonstrate how to add AdSense Ads to a WordPress Website, and how to set up WordPress to automatically place Ads in Sidebars. This will be demonstrated using a Windows 8 PC. Log into your AdSense account. : Cli…
Suggested Courses

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question