Wordfence and PHP-FPM high cpu usage

Hi:
thank you for your help.

I have been send diagnostic report to [email protected].

Hi @shockhuang, thanks for sending your diagnostic over!

I can’t see any communications issues/errors to and from your server that might point to unusually long times. Naturally during most times as they update frequently, it’s normal to see the wflogs files open.

I can see max_execution_time in your php.ini is set to 1000, which is way more than our recommendation of 30, so might be the reason why transactions are being held open and using a lot of processing power for a long time. You can check the error logs after this change to see if any hits actually reach the 30 second limit.

In Recently removed wflogs files, you had a lot of temp files removed on May 9. This may not be related if you’re no longer seeing that, but it could be an indication of file locking issues on the server.

By the database tables in diagnostics, there is a “Tables missing” message. That might mean this site was installed on Windows and moved to Linux. If you can deactivate Wordfence, wait a few seconds, then activate it again, it may fix that issue.

Thanks,

Peter.

Hi!

thank you for your help.

I have already configure my max_execution_time 30,

after that , I got these in my php error log

[20-Jun-2022 11:31:52] WARNING: [pool www] child 25986, script '/opt/bitnami/apps/wordpress/htdocs/index.php' (request: "GET /index.php") executing too slow (3.094648 sec), logging
[20-Jun-2022 11:32:01] WARNING: [pool www] child 25990, script '/opt/bitnami/apps/wordpress/htdocs/index.php' (request: "GET /index.php") executing too slow (3.208239 sec), logging
[20-Jun-2022 11:32:03] WARNING: [pool www] child 25992, script '/opt/bitnami/apps/wordpress/htdocs/index.php' (request: "GET /index.php?add-to-cart=3875javascript:xssdetected(2535177213572000009410911n)//*/javascript:javascript:%22/*%27/*

/*–%3E%3C/noscript%3E%3C/title%3E%3C/textarea%3E%3C/style%3E%3C/template%3E%3C/noembed%3E%3C/script%3E%3Chtml%20%22%20onmouseover%3d/*%26lt;svg/*/onload%3dxssdetected(2535177213572000009410911n)onload%3dxssdetected(2535177213572000009410911n)//%3E%3Csvg%20onload%3dxssdetected(2535177213572000009410911n)%3E%3Csvg%20onload%3dxssdetected(2535177213572000009410911n)%3E*/%3C/style%3E%3Cscript%3Exssdetected(25″) executing too slow (3.560655 sec), logging
[20-Jun-2022 11:32:05] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695917.3719”) executing too slow (3.371899 sec), logging
[20-Jun-2022 11:32:05] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695917.5971”) executing too slow (3.297162 sec), logging
[20-Jun-2022 11:32:06] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695917.6573”) executing too slow (3.710734 sec), logging
[20-Jun-2022 11:32:09] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695918.7488”) executing too slow (3.718548 sec), logging
[20-Jun-2022 11:32:10] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695918.8351”) executing too slow (3.671399 sec), logging
[20-Jun-2022 11:32:10] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695918.8792”) executing too slow (3.206105 sec), logging
[20-Jun-2022 11:32:11] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695919.2143”) executing too slow (3.736381 sec), logging
[20-Jun-2022 11:32:13] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695919.5609”) executing too slow (3.313503 sec), logging
[20-Jun-2022 11:32:15] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.301697 sec), logging
[20-Jun-2022 11:32:15] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.295012 sec), logging
[20-Jun-2022 11:32:16] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695920.4525”) executing too slow (3.341669 sec), logging
[20-Jun-2022 11:32:25] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.432976 sec), logging
[20-Jun-2022 11:32:26] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.069539 sec), logging
[20-Jun-2022 11:32:26] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.474007 sec), logging
[20-Jun-2022 11:32:26] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.606712 sec), logging
[20-Jun-2022 11:32:26] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.516894 sec), logging
[20-Jun-2022 11:32:31] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.230247 sec), logging
[20-Jun-2022 11:32:34] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.056747 sec), logging
[20-Jun-2022 11:32:38] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695932.288”) executing too slow (3.449123 sec), logging
[20-Jun-2022 11:32:38] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695932.6358”) executing too slow (3.165390 sec), logging
[20-Jun-2022 11:32:38] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695931.8471”) executing too slow (3.734022 sec), logging
[20-Jun-2022 11:32:39] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695932.6589”) executing too slow (3.954701 sec), logging
[20-Jun-2022 11:32:45] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695943.4335”) executing too slow (3.013405 sec), logging
[20-Jun-2022 11:32:45] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695943.3662”) executing too slow (3.082560 sec), logging
[20-Jun-2022 11:32:45] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695942.5704”) executing too slow (3.817028 sec), logging
[20-Jun-2022 11:32:46] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695943.467”) executing too slow (3.785064 sec), logging
[20-Jun-2022 11:32:50] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695946.1324”) executing too slow (3.477632 sec), logging
[20-Jun-2022 11:32:51] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695947.279”) executing too slow (3.864886 sec), logging
[20-Jun-2022 11:32:51] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695947.2309”) executing too slow (3.908650 sec), logging
[20-Jun-2022 11:32:52] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695947.2868”) executing too slow (3.009603 sec), logging
[20-Jun-2022 11:32:53] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695947.5588”) executing too slow (3.028313 sec), logging
[20-Jun-2022 11:32:55] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695947.5955”) executing too slow (3.882263 sec), logging
[20-Jun-2022 11:33:07] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php?v=3d9975706be3&add-to-cart=3793”) executing too slow (3.988815 sec), logging
[20-Jun-2022 11:33:10] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695976.6112”) executing too slow (3.284507 sec), logging
[20-Jun-2022 11:33:10] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695975.5048”) executing too slow (3.943645 sec), logging
[20-Jun-2022 11:33:10] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695976.2642”) executing too slow (3.658561 sec), logging
[20-Jun-2022 11:33:11] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695976.733”) executing too slow (3.653009 sec), logging
[20-Jun-2022 11:33:13] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695977.0115”) executing too slow (3.768964 sec), logging
[20-Jun-2022 11:33:15] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695977.9218”) executing too slow (3.648322 sec), logging
[20-Jun-2022 11:33:15] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695978.16”) executing too slow (3.033092 sec), logging
[20-Jun-2022 11:33:15] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695977.6232”) executing too slow (3.682393 sec), logging
[20-Jun-2022 11:33:15] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695978.1112”) executing too slow (3.643799 sec), logging
[20-Jun-2022 11:33:17] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695978.3506”) executing too slow (3.177321 sec), logging
[20-Jun-2022 11:33:25] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.785701 sec), logging
[20-Jun-2022 11:33:28] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.032398 sec), logging
[20-Jun-2022 11:33:30] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655695999.3168”) executing too slow (3.806184 sec), logging
[20-Jun-2022 11:33:31] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696000.0814”) executing too slow (3.841603 sec), logging
[20-Jun-2022 11:33:31] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696000.4903”) executing too slow (3.157160 sec), logging
[20-Jun-2022 11:33:32] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696000.7201”) executing too slow (3.799362 sec), logging
[20-Jun-2022 11:33:32] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696000.7815”) executing too slow (3.477539 sec), logging
[20-Jun-2022 11:33:34] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696001.0015”) executing too slow (3.201658 sec), logging
[20-Jun-2022 11:33:36] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696001.9335”) executing too slow (3.109300 sec), logging
[20-Jun-2022 11:33:36] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696001.4601”) executing too slow (3.620796 sec), logging
[20-Jun-2022 11:33:37] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696002.2315”) executing too slow (3.706305 sec), logging
[20-Jun-2022 11:33:38] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696002.2413”) executing too slow (3.460306 sec), logging
[20-Jun-2022 11:33:44] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.211254 sec), logging
[20-Jun-2022 11:33:49] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696017.9107”) executing too slow (3.115082 sec), logging
[20-Jun-2022 11:33:49] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696017.8263”) executing too slow (3.276918 sec), logging
[20-Jun-2022 11:33:51] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696018.39”) executing too slow (3.787880 sec), logging
[20-Jun-2022 11:33:51] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696018.4893”) executing too slow (3.641435 sec), logging
[20-Jun-2022 11:33:54] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696019.5995”) executing too slow (3.526921 sec), logging
[20-Jun-2022 11:33:54] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696019.2528”) executing too slow (3.780218 sec), logging
[20-Jun-2022 11:33:55] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696020.1587”) executing too slow (3.190442 sec), logging
[20-Jun-2022 11:33:55] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696019.8009”) executing too slow (3.687076 sec), logging
[20-Jun-2022 11:33:55] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696019.8625”) executing too slow (3.388701 sec), logging
[20-Jun-2022 11:34:16] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.053743 sec), logging
[20-Jun-2022 11:34:20] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.373060 sec), logging
[20-Jun-2022 11:34:20] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.248979 sec), logging
[20-Jun-2022 11:34:20] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.033140 sec), logging
[20-Jun-2022 11:34:22] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php”) executing too slow (3.072349 sec), logging
[20-Jun-2022 11:34:25] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “GET /index.php?v=3d9975706be3&add-to-cart=3798”) executing too slow (3.303490 sec), logging
[20-Jun-2022 11:34:33] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696058.0257”) executing too slow (3.243719 sec), logging
[20-Jun-2022 11:34:33] WARNING: [pool www] child 25986, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696057.8035”) executing too slow (3.418115 sec), logging
[20-Jun-2022 11:34:35] WARNING: [pool www] child 25987, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696060.0381”) executing too slow (3.180108 sec), logging
[20-Jun-2022 11:34:36] WARNING: [pool www] child 25992, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696060.2222”) executing too slow (3.297879 sec), logging
[20-Jun-2022 11:34:39] WARNING: [pool www] child 25993, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696061.3018”) executing too slow (3.702395 sec), logging
[20-Jun-2022 11:34:39] WARNING: [pool www] child 25990, script ‘/opt/bitnami/apps/wordpress/htdocs/index.php’ (request: “POST /index.php?wordfence_syncAttackData=1655696061.2956”) executing too slow (3.762951 sec), logging`

Hi @shockhuang, thanks for the extra log information after changing that.

The “executing too slow” messages can happen in PHP-FPM, but they’re often off by default. In this case they look to be enabled and set to 3 seconds.

In the list of slow processes, the third one includes /index.php?add-to-cart=3875javascript: followed by a payload that looks like it’s from a pentest tool. Assuming you’re not having penetration testing on your site, that’s probably an attacker probing the site. Your access log at the time of the slowness would also show this.

There are also some regular index.php requests mixed in which are also slow, along with a bunch of Wordfence syncAttackData hits. These should be throttled normally and don’t usually take 3 seconds or more. However, it’s likely the server is being overwhelmed by the attack/probing, and starting them before the throttling can kick in.

You have the option to increase the server’s resources so it doesn’t get slow during attacks, or configuring the web server to serve fewer visitors in parallel which are possible by speaking with your host or server administrator if required. As far as Wordfence goes, you could try switching your logs to the MySQLi engine to reduce the amount of file hits that we attempt: https://www.wordfence.com/help/firewall/mysqli-storage-engine/

Thanks again,

Peter.