By gabba
I’ve built a openlitespeed/wordpress droplet with a few virtual hosts, and its working very well, however after being up for a day or so CPU suddenly spikes with random command, this from top:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 23393 www-data 20 0 307664 271644 1396 S 398.7 3.3 14352:32 0rg9ibzwy2qqsha
and if i trace the PID i just get loads of this:
clock_gettime(CLOCK_REALTIME, {tv_sec=1587394760, tv_nsec=35992503}) = 0 clock_gettime(CLOCK_REALTIME, {tv_sec=1587394760, tv_nsec=36142007}) = 0
is it some kind of basic setting thats missing and putting it into a death spiral?
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
looks to be a virus:
lrwxrwxrwx 1 www-data www-data 0 Apr 18 02:49 /proc/23393/exe -> /var/www/html/wp-content/themes/twentynineteen/xmrig64
which as its a one-click droplet is a bit worrying
Hi @gabba,
There’s no issue on my multiple testing sites.
Since it’s a migrated site, please try using some scanner tool, e.g. Worldfence to check if there’s any code issue. And turn off/disable any suspicious plugins and theme.
By the way, I have replied your ticket.
Best, Eric
thanks Eric, i’ll keep an eye on it, but your right must be a file from the migration, just strange it ended up in the theme directory that i hadn’t copied files into.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and AI-native businesses
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.