Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Wordpress site spawning many php-cgi.exe processes with no site traffic

Posted on 2014-09-27
4
Medium Priority
?
3,229 Views
Last Modified: 2014-10-03
Here's the scenario:

I have three (3) separate WP websites running on a 64-bit Win 2008 R2 Server. All sites are setup identically using:
- FastCGI
- InstanceMaxRequests = 10000
- PHP_FCGI_MAX_REQUESTS =10000
- Separate app pools (integrated)
- All app pools identical in settings

While testing for the last few hours all sites has close to zero traffic...but...when I look at the process manager I find this:

Site #1 - one php-cgi.exe process running
Site #2 - dozens of php-cgi.exe processes running (always up to the Max Instances value)
Site #3 - dozens of php-cgi.exe processes running (always up to the Max Instances value)

Many of the processes are at zero cpu usage but are hogging memory.

The strange thing is that no matter what I do on site #1 (connecting with multiple browsers etc.) the site uses just one or two processes, and shuts them down pretty efficiently when done.

On sites #2 and #3 I can stop the app pool, make sure all processes are gone, then within a few seconds of restarting the app pool they have once again spawned the maximum number of php-cgi.exe processes (depending on what I have set as the Max Instances - I've tried it with many values from 0 to 50, and the results never vary). BTW, when I have Max Instances set to 0, sites 2 & 3 will spawn enough processes to spike the CPU at 100%.

Here's what I have tried, with no luck:

- Updating WP and all Pluings to most current versions
- Deactivating all plugins entirely
- Changing theme to a fresh WP 2014 theme
- Installing WordFence and blocking any IP ranges outside the USA (although there was only two hits from those the entire evening).
- Scanning with WordFence to find any security flaws (it came up with a clean bill of health)

So, what am I missing here?  Where do I look to figure out why one site runs beautifully and the other two act up?
0
Comment
Question by:worthyking1
  • 3
4 Comments
 
LVL 70

Expert Comment

by:Jason C. Levine
ID: 40348205
Are you logged into the WordPress Dashboard when these processes spawn?
0
 
LVL 6

Author Comment

by:worthyking1
ID: 40348786
It makes no difference. They spin up regardless of whether I am logged into the WP dashboard or not.
0
 
LVL 6

Accepted Solution

by:
worthyking1 earned 0 total points
ID: 40348852
Okay, i solved it. After digging through the server logs I discovered that the source of the problem was an attack on the xmlrpc.php file.  I know that (according to WP) there is no security issue any longer with this but it seems some idiot hackers still like to keep banging on it trying to get something to happen.

The two sites in question both had non-stop traffic coming primarily for the Ecatel Ltd. network in the Netherlands and one or two other random IPs from France, si I simply blocked those IP ranges using the Windows Firewall as I don't want this traffic to even reach as far as IIS.

Logs are back to being real small and CPU is normal. WP is spawning php-cgi.exe processes only as needed and recycling them normally.

Here's a decent thread describing the same issue (although with Linux solutions rather than Win 2008):
https://wordpress.org/support/topic/xmlrpcphp-attack-on-wordpress-38
0
 
LVL 6

Author Closing Comment

by:worthyking1
ID: 40358955
Being that there were no solutions provided by the membership I had to keep cracking until I solved it myself.  truthfully, I should have looked at my logs right at the beginning but the WP angle threw me off my normal game.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

WordPress can be pretty daunting, especially for a beginner, so I thought it might be a good idea to write an article to show how easy it is to get started in WordPress and to design a custom theme.  The first step is to check with your hosting comp…
Lync server 2013 or Skype for business Backup Service Error ID 4049 – After File Share Migration
The purpose of this video is to demonstrate how to properly insert a Vimeo Video into a WordPress site or Blog. This will be demonstrated using a Windows 8 PC. Go to your WordPress login page. This will look like the following: mywebsite.com/wp…
The purpose of this video is to demonstrate how to manually back up a WordPress Database. This will be demonstrated using a Windows 8 PC. The Host used will be IPage.com Log into your Hosting account. IPage will be used for demonstration : Locat…
Suggested Courses

782 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question