Question

Openlitespeed droplet keeps spiking at 400% cpu with a random command name, stops on reboot, timestamp settings?

Posted April 20, 2020 379 views
Linux BasicsApacheUbuntu 18.04

I’ve built a openlitespeed/wordpress droplet with a few virtual hosts, and its working very well, however after being up for a day or so CPU suddenly spikes with random command, this from top:

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
23393 www-data 20 0 307664 271644 1396 S 398.7 3.3 14352:32 0rg9ibzwy2qqsha

and if i trace the PID i just get loads of this:

clockgettime(CLOCKREALTIME, {tvsec=1587394760, tvnsec=35992503}) = 0
clockgettime(CLOCKREALTIME, {tvsec=1587394760, tvnsec=36142007}) = 0

is it some kind of basic setting thats missing and putting it into a death spiral?

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
3 answers

thanks Eric, i’ll keep an eye on it, but your right must be a file from the migration, just strange it ended up in the theme directory that i hadn’t copied files into.

looks to be a virus:

lrwxrwxrwx 1 www-data www-data 0 Apr 18 02:49 /proc/23393/exe -> /var/www/html/wp-content/themes/twentynineteen/xmrig64

which as its a one-click droplet is a bit worrying

Hi @gabba,

There’s no issue on my multiple testing sites.

Since it’s a migrated site, please try using some scanner tool, e.g. Worldfence to check if there’s any code issue. And turn off/disable any suspicious plugins and theme.

By the way, I have replied your ticket.

Best,
Eric

Submit an Answer