Help where to debug what causes brand-new ec2 instance and WP install to CPU spi

  • eclair4151

    (@eclair4151)


    1 year ago

    This is an issue I’ve had over a few work places environments, and I am finally trying to get to the root of what causes this type of event to occur.

    I have a brand spanking new ec2 instance which is a new dev server for a website we are making. It only has 1GB of ram, because I am the only person with access. PHP and wordpress memory limits are 512M which again I think should be more than enough for a single dev and 0 traffic

    Randomly once every day to a few days (When nobody, not even me is using it), the entire instance just goes down. Based on the AWS monitor, the CPU spikes to 100% which causes the instance to shut down.

    There is no way to SSH in or do anything, the entire thing is locked up until you reboot from the console.

    I am running apache, and these are the logs I found from the last event, but they dont mean much to me.

    Does anyone know why this type of event occurs? IE is something to do with ram running out, or is there something else just stuck in an infinite loop? how do I even debug this? what steps can I put in place to help debug what causes this.

    Its very annoying because once it happens I can no longer SSH in to run HTOP or debug, so everything has to be running and logging all the time so I can check after rebooting it.

    Here are some random logs during the event I was able to pull from /etc/log/httpd and /etc/log/php-fdm

    The php error log seems to be the most telling, and the access logs look like it was trying to do something with cron. any way for me to debug what in cron was running?

    No idea why pool WWW seems busy and it ends up spawing 50 children, when nobody is accessing the website.

    PHP Error log

    [02-Nov-2023 03:26:05] WARNING: [pool www] seems busy (you may need to increase pm.start_servers, or pm.min/max_spare_servers), spawning 8 children, there are 0 idle, and 22 total children

    [02-Nov-2023 03:26:06] WARNING: [pool www] seems busy (you may need to increase pm.start_servers, or pm.min/max_spare_servers), spawning 16 children, there are 0 idle, and 27 total children

    [02-Nov-2023 03:26:08] WARNING: [pool www] seems busy (you may need to increase pm.start_servers, or pm.min/max_spare_servers), spawning 32 children, there are 1 idle, and 32 total children

    [02-Nov-2023 03:26:09] WARNING: [pool www] seems busy (you may need to increase pm.start_servers, or pm.min/max_spare_servers), spawning 32 children, there are 0 idle, and 36 total children

    [02-Nov-2023 03:26:27] WARNING: [pool www] seems busy (you may need to increase pm.start_servers, or pm.min/max_spare_servers), spawning 32 children, there are 0 idle, and 41 total children

    [02-Nov-2023 03:26:44] WARNING: [pool www] seems busy (you may need to increase pm.start_servers, or pm.min/max_spare_servers), spawning 32 children, there are 0 idle, and 46 total children

    [02-Nov-2023 03:27:07] WARNING: [pool www] server reached pm.max_children setting (50), consider raising it

    [02-Nov-2023 04:03:34] NOTICE: Terminating …

    [02-Nov-2023 04:03:34] NOTICE: exiting, bye-bye!

    .

    .

    HTTPD Error:

    [Thu Nov 02 03:27:04.247250 2023] [proxy_fcgi:error] pid 3227:tid 3269The timeout specified has expired: [client 172.70.134.105:14062] AH01075: Error dispatching request to : (polling)

    [Thu Nov 02 03:27:04.247216 2023] [proxy_fcgi:error] pid 3227:tid 3262The timeout specified has expired: [client 172.70.34.178:59360] AH01075: Error dispatching request to : (polling)

    [Thu Nov 02 03:27:04.247174 2023] [proxy_fcgi:error] pid 3049:tid 3195The timeout specified has expired: [client 172.70.38.155:57542] AH01075: Error dispatching request to : (polling)

    [Thu Nov 02 03:27:04.247163 2023] [proxy_fcgi:error] pid 3227:tid 3255The timeout specified has expired: [client 172.70.38.148:57988] AH01075: Error dispatching request to : (polling)

    .

    .

    HTTP Access Log

    172.70.42.30 - - [02/Nov/2023:03:25:50 +0000] "GET / HTTP/1.1" 200 32577 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.35 Safari/537.36"

    172.69.58.194 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0529561042785644531250 HTTP/1.1" 200 - "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.69.58.142 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0128350257873535156250 HTTP/1.1" 200 - "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.70.126.235 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0103580951690673828125 HTTP/1.1" 200 - "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.69.59.51 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0394148826599121093750 HTTP/1.1" 200 - "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.70.131.180 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0379879474639892578125 HTTP/1.1" 200 - "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.70.175.197 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/themes/astra/assets/js/minified/frontend.min.js HTTP/1.1" 301 - "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/11.0 Mobile/15D100 Safari/604.1"

    172.70.134.155 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js HTTP/1.1" 301 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"

    172.69.58.117 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0209090709686279296875 HTTP/1.1" 200 - "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.70.126.65 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0120279788970947265625 HTTP/1.1" 200 - "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.70.34.58 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/themes/astra/assets/js/minified/mobile-cart.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3880.0 Safari/537.36"

    172.70.135.68 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js HTTP/1.1" 504 247 "-" "Opera/7.51 (Windows NT 5.1; U) [en]"

    172.69.58.23 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0156779289245605468750 HTTP/1.1" 504 247 "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.71.222.176 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/dist/vendor/wp-polyfill.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3"

    172.70.38.45 - - [02/Nov/2023:03:26:02 +0000] "GET /wp-emoji-release.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1"

    172.70.179.54 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0185821056365966796875 HTTP/1.1" 504 247 "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.70.179.122 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0348119735717773437500 HTTP/1.1" 504 247 "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.70.43.179 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/jquery/jquery.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.2.1"

    172.71.254.214 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0726790428161621093750 HTTP/1.1" 504 247 "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.70.135.70 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/themes/astra/assets/js/minified/flexibility.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Linux; Android 4.4.4; XT1032 Build/KXB21.14-L1.61) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.94 Mobile Safari/537.36"

    172.70.134.148 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36"

    172.71.222.142 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js HTTP/1.1" 504 247 "-" "SAMSUNG-S8000/S8000XXIF3 SHP/VPP/R5 Jasmine/1.0 Nextreaming SMM-MMS/1.2.0 profile/MIDP-2.1 configuration/CLDC-1.1 FirePHP/0.3"

    172.70.34.251 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Windows Phone 8.1; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; NOKIA; Lumia 630) like Gecko"

    172.70.38.56 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36"

    172.70.39.164 - - [02/Nov/2023:03:26:02 +0000] "GET //stats.wp.com/w.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"

    172.71.223.167 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js HTTP/1.1" 504 247 "-" "Opera/9.80 (Android; Opera Mini/7.6.40234/151.113; U; en) Presto/2.12.423 Version/12.16"

    172.70.135.115 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/subscriptions-for-woocommerce/public/js/subscriptions-for-woocommerce-public.js HTTP/1.1" 504 247 "-" "Opera/10.61 (J2ME/MIDP; Opera Mini/5.1.21219/19.999; en-US; rv:1.9.3a5) WebKit/534.5 Presto/2.6.30"

    172.70.38.148 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js HTTP/1.1" 504 247 "-" "SonyEricssonW995/R1EA Profile/MIDP-2.1 Configuration/CLDC-1.1 UNTRUSTED/1.0"

    172.70.42.190 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/wp-util.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.186 Safari/535.1"

    172.70.39.120 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/elementor/assets/js/frontend.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Linux; U; Android 3.0.1; en-us; GT-P7100 Build/HRI83) AppleWebkit/534.13 (KHTML, like Gecko) Version/4.0 Safari/534.13"

    172.70.100.105 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0605280399322509765625 HTTP/1.1" 504 247 "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.70.42.115 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"

    172.71.223.167 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/lib/mailcheck.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36"

    172.70.42.197 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/lib/punycode.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.36 Safari/535.7"

    172.71.223.9 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/jquery/ui/core.min.js HTTP/1.1" 504 247 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)"

    172.70.34.178 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/underscore.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13F69 Safari/601.1"

    172.70.38.120 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (iPod touch; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit/537.51.2 (KHTML like Gecko) Version/7.0 Mobile/11D167 Safari/123E71C"

    172.70.39.115 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36"

    172.70.38.190 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/dist/hooks.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G965F Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36"

    162.158.79.201 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/js/wpforms.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/540.0 (KHTML, like Gecko) Ubuntu/10.10 Chrome/9.1.0.0 Safari/540.0"

    172.70.38.155 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/js/utils.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36"

    172.71.222.80 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js HTTP/1.1" 504 247 "-" "Lynx/2.8.5rel.1 libwww-FM/2.14 SSL-MM/1.4.1 GNUTLS/0.8.12"

    172.69.59.162 - - [02/Nov/2023:03:26:08 +0000] "POST /wp-cron.php?doing_wp_cron=1698895568.0309081077575683593750 HTTP/1.1" 504 247 "-" "WordPress/6.3.2; https://dev.canyonrunnerapp.com"

    172.70.134.105 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/lib/jquery.validate.min.js HTTP/1.1" 504 247 "-" "UCWEB/8.8 (iPhone; CPU OS_6; en-US)AppleWebKit/534.1 U3/3.0.0 Mobile"

    172.70.42.129 - - [02/Nov/2023:03:26:02 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/jquery/jquery-migrate.min.js HTTP/1.1" 504 247 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36"

    172.70.174.100 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36"

    172.71.222.171 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.11) Gecko/2009060215 Firefox/3.0.11 (.NET CLR 3.5.30729)"

    172.70.174.59 - - [02/Nov/2023:03:27:17 +0000] "GET //stats.wp.com/w.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10"

    172.70.134.156 - - [02/Nov/2023:03:27:20 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/wp-util.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"

    172.70.42.102 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-AU) AppleWebKit/534.35 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.35 Puffin/3.9174IT"

    172.70.174.32 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/jquery/jquery.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"

    162.158.79.122 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/jquery/ui/core.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Linux; Android 8.0.0; moto e5 plus Build/OPPS27.91-122-3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.126 Mobile Safari/537.36"

    172.71.222.111 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-content/themes/astra/assets/js/minified/mobile-cart.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"

    172.70.35.50 - - [02/Nov/2023:03:27:17 +0000] "GET /wp-emoji-release.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15G77 MicroMessenger/7.0.3(0x17000321) NetType/WIFI Language/zh_CN"

    172.70.134.28 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/lib/punycode.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 YaBrowser/19.7.2.455 Yowser/2.5 Safari/537.36"

    172.70.134.161 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/607.2.6 (KHTML, like Gecko) Version/12.1.1 Safari/607.2.6 Maxthon/5.1.132"

    172.70.38.254 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36"

    172.70.174.9 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/js/utils.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; WOW64; Trident/5.0)"

    172.70.42.191 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/elementor/assets/js/frontend.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (WindowsCE 6.0; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

    172.71.223.134 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/subscriptions-for-woocommerce/public/js/subscriptions-for-woocommerce-public.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Linux; Android 9; Mi A2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"

    172.70.175.90 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/dist/vendor/wp-polyfill.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko/48.0 Firefox/48.0"

    172.70.35.16 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js HTTP/1.1" 408 221 "-" "iTunes/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)"

    172.70.43.16 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Linux; Android 4.1.2; GT-N8013) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.99 Safari/537.36"

    172.70.175.82 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/jquery/jquery-migrate.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (iPhone; U; CPU iPhone OS) (compatible; Googlebot-Mobile/2.1; https://www.google.com/bot.html)"

    172.71.222.20 - - [02/Nov/2023:03:27:17 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js HTTP/1.1" 408 221 "-" "Mediapartners-Google"

    172.70.39.181 - - [02/Nov/2023:03:27:20 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/lib/mailcheck.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3872.0 Safari/537.36 Edg/78.0.244.0"

    172.70.43.168 - - [02/Nov/2023:03:27:20 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/js/wpforms.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us; Silk/1.0.13.81_10003810) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 Silk-Accelerated=true"

    172.70.39.34 - - [02/Nov/2023:03:27:20 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Linux; U; Android 1.6; en-us; SonyEricssonX10i Build/R1AA056) AppleWebKit/528.5 (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1"

    162.158.78.180 - - [02/Nov/2023:03:27:20 +0000] "GET //dev.canyonrunnerapp.com/wp-content/themes/astra/assets/js/minified/flexibility.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G965W Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36"

    172.70.39.115 - - [02/Nov/2023:03:27:38 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.min.js HTTP/1.1" 408 221 "-" "FAST-WebCrawler/3.8 (crawler at trd dot overture dot com; https://www.alltheweb.com/help/webmaster/crawler)"

    172.70.38.121 - - [02/Nov/2023:03:27:38 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js HTTP/1.1" 408 221 "-" "MOT-V9mm/00.62 UP.Browser/6.2.3.4.c.1.123 (GUI) MMP/2.0"

    172.70.34.178 - - [02/Nov/2023:03:27:40 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/underscore.min.js HTTP/1.1" 408 221 "-" "Mozilla/5.0 (Windows NT 10.0; ARM; Lumia 950 Dual SIM) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393"

    198.235.24.229 - - [02/Nov/2023:03:33:45 +0000] "GET / HTTP/1.0" 503 299 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: [email protected]"

    162.158.79.177 - - [02/Nov/2023:03:27:21 +0000] "GET //dev.canyonrunnerapp.com/wp-includes/js/dist/hooks.min.js HTTP/1.1" 503 299 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/16B92 MicroMessenger/7.0.5(0x17000523) NetType/WIFI Language/zh_CN"

    172.70.38.223 - - [02/Nov/2023:03:27:21 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js HTTP/1.1" 503 299 "-" "Opera/9.80 (X11; Linux x86_64; U; pl) Presto/2.7.62 Version/11.00"

    172.70.38.190 - - [02/Nov/2023:03:27:21 +0000] "GET //dev.canyonrunnerapp.com/wp-content/themes/astra/assets/js/minified/frontend.min.js HTTP/1.1" 503 299 "-" "Mozilla/5.0 (Linux; Android 7.0; Vivo 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"

    172.70.175.168 - - [02/Nov/2023:03:27:21 +0000] "GET //dev.canyonrunnerapp.com/wp-content/plugins/wpforms-lite/assets/lib/jquery.validate.min.js HTTP/1.1" 503 299 "-" "Mozilla/5.0 (Linux; Android 8.1.0; GM 6 d) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"

    35.203.211.230 - - [02/Nov/2023:03:41:07 +0000] "GET / HTTP/1.1" 503 299 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: [email protected]"

    94.102.61.10 - - [02/Nov/2023:03:41:16 +0000] "GET / HTTP/1.1" 503 299 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36"

    135.125.246.189 - - [02/Nov/2023:03:42:36 +0000] "GET /.env HTTP/1.1" 503 299 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"

    172.71.214.168 - - [02/Nov/2023:04:07:47 +0000] "GET / HTTP/1.1" 200 32577 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"

    172.71.218.130 - - [02/Nov/2023:04:07:51 +0000] "GET /favicon.ico HTTP/1.1" 503 299 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"

    198.235.24.34 - - [02/Nov/2023:04:26:37 +0000] "\x16\x03\x01" 400 226 "-" "-"

    198.235.24.34 - - [02/Nov/2023:04:26:37 +0000] "\x16\x03\x01" 400 226 "-" "-"

Viewing 1 replies (of 1 total)
  • Moderator bcworkz

    (@bcworkz)

    A WP Cron job can take very minimal resource or it can use up a lot. It depends on what the scheduled task was. A WP cron job will not execute unless someone or something makes a request to WP. If no one is accessing the site, then no cron jobs will run. Clearly someone or thing is accessing the site, from various IP addresses no less. They might all be within the same CIDR block though.

    You can learn what scheduled cron jobs are still queued by examining the “cron” option. It can be accessed through the phpMyAdmin app as well as through other possible methods. The record will tell you how often each job executes and what the callback’s name is. You can search for the callback function declaration to see what it really does.

    If this problem happens often enough that you can be sure a particular change resolves the problem (as opposed to the problem is yet to arise again), you could selectively deactivate plugins or switch themes to isolate which module is causing the problem. Of course you’ll lose some functionality or appearance will change in the process. This is why it’s important that the problem recurs fairly frequently so your site isn’t hampered by this investigation for long periods of time.

Viewing 1 replies (of 1 total)
  • The topic ‘Help where to debug what causes brand-new ec2 instance and WP install to CPU spi’ is closed to new replies.