Hi there @sawmebabe,

It really would depend on what you have installed on your Droplet. For example if you are running Nginx or Apache the high CPU usage could be caused by a spike in the traffic either caused by regular visitors or malicious activity like a brute-force attack or bad bots crawling your website.

What I usually do in such cases is to check my access logs, that way I would know what exactly was going on during that high CPU period of time.

You can either do this manually by using the grep command to search for the exact period of time in your access logs. For example, let’s say that the high CPU accrued on 05 April at 7AM, you could run the following to get all entries for this period of time:

zgrep '05/Apr/2020:07:30' /var/log/apache2/access.log*

Another thing that you could try using is this script here which summarizes your access logs. It would summarize your access log and give you the following information:

• Top 20 POST requests
• Top 20 GET requests
• Top 20 IP logs and their geo-location

Another thing that could be causing the high CPU load is a cron job or any other scheduled task. I would recommend checking your crontab and reviewing your cron jobs. To do that you can run this command here:

crontab -l

Hope that this helps!
Regards,
Bobby