High Unexpected CPU Usage

I had the same problem now I found a solution I hope it will work for you. actually, someone was attacking with a brute force attack on my website so why my website was down and the graph shows CPU 100% usage.

First of all, check which application takes much usage so enter the command “top” it will show the real-time CPU usage. in my case, PHP-fpm was taking 95% usage.

Now you have to check your Nginx log file. “sudo tail -f /var/log/nginx/access.log” it will show the error or bad gateway access details… now you have to copy the IP address which is repeated a lot of times you have to block it.

You can block IP by using this command “iptables -I INPUT -s 35.186.156.199 -j DROP”

I hope this issue will be resolved.

Hi there @sawmebabe,

It really would depend on what you have installed on your Droplet. For example if you are running Nginx or Apache the high CPU usage could be caused by a spike in the traffic either caused by regular visitors or malicious activity like a brute-force attack or bad bots crawling your website.

What I usually do in such cases is to check my access logs, that way I would know what exactly was going on during that high CPU period of time.

You can either do this manually by using the grep command to search for the exact period of time in your access logs. For example, let’s say that the high CPU accrued on 05 April at 7AM, you could run the following to get all entries for this period of time:

zgrep '05/Apr/2020:07:30' /var/log/apache2/access.log*

Another thing that you could try using is this script here which summarizes your access logs. It would summarize your access log and give you the following information:

• Top 20 POST requests
• Top 20 GET requests
• Top 20 IP logs and their geo-location

Another thing that could be causing the high CPU load is a cron job or any other scheduled task. I would recommend checking your crontab and reviewing your cron jobs. To do that you can run this command here:

crontab -l

Hope that this helps! Regards, Bobby