I’ve built a openlitespeed/wordpress droplet with a few virtual hosts, and its working very well, however after being up for a day or so CPU suddenly spikes with random command, this from top:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 23393 www-data 20 0 307664 271644 1396 S 398.7 3.3 14352:32 0rg9ibzwy2qqsha
and if i trace the PID i just get loads of this:
clock_gettime(CLOCK_REALTIME, {tv_sec=1587394760, tv_nsec=35992503}) = 0 clock_gettime(CLOCK_REALTIME, {tv_sec=1587394760, tv_nsec=36142007}) = 0
is it some kind of basic setting thats missing and putting it into a death spiral?
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
thanks Eric, i’ll keep an eye on it, but your right must be a file from the migration, just strange it ended up in the theme directory that i hadn’t copied files into.
Hi @gabba,
There’s no issue on my multiple testing sites.
Since it’s a migrated site, please try using some scanner tool, e.g. Worldfence to check if there’s any code issue. And turn off/disable any suspicious plugins and theme.
By the way, I have replied your ticket.
Best, Eric
looks to be a virus:
lrwxrwxrwx 1 www-data www-data 0 Apr 18 02:49 /proc/23393/exe -> /var/www/html/wp-content/themes/twentynineteen/xmrig64
which as its a one-click droplet is a bit worrying