Skip to main content

PHP-FPM often shows up in top when no one is on site

tagteam
Often when I am watching top to see what is going on I will see php-fpm show up for a users account when no one is on the site. It will show up with around a 20% cpu hit and then go away. It will pop in and out for a while but as I am watching analytics no one is actually on the site. Does anyone know why this is happening?

Comments

4 comments

Date Votes
  • tagteam
    Upon further review this appears to be bots hitting the site. For example one bot mj12bot.com hits it all the time. I disallowed that bot in the robots.txt file but it still seems to be hitting the site multiple times a minute. It mainly looks to be hitting my calendar. 144.91.125.96 - - [08/Dec/2020:11:25:36 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-24&paged=12 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 144.91.125.96 - - [08/Dec/2020:11:25:51 -0600] "GET /page/12/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-24 HTTP/1.1" 200 31386 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 144.91.125.96 - - [08/Dec/2020:11:26:02 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28&paged=2 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 144.91.125.96 - - [08/Dec/2020:11:26:13 -0600] "GET /page/2/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28 HTTP/1.1" 200 31383 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 144.91.125.96 - - [08/Dec/2020:11:26:26 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28&paged=6 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 144.91.125.96 - - [08/Dec/2020:11:26:34 -0600] "GET /page/6/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28 HTTP/1.1" 200 31380 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 144.91.125.96 - - [08/Dec/2020:11:26:48 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30&paged=6 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 144.91.125.96 - - [08/Dec/2020:11:26:57 -0600] "GET /page/6/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30 HTTP/1.1" 200 31381 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 144.91.125.96 - - [08/Dec/2020:11:27:10 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30&paged=8 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 144.91.125.96 - - [08/Dec/2020:11:27:22 -0600] "GET /page/8/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30 HTTP/1.1" 200 31381 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" Can anyone confirm that this is what I am seeing? It appears to be coming from the same IP so I could block that i suppose but the mj12bot.com site says they user a range of ip's so if it is really them I don't know if it will help.
    0
  • cPRex Jurassic Moderator
    Hey there! That traffic is definitely their bot, so you could block the IP you're currently seeing accessing the server. If you see the IP change in the future you could just block an additional IP. That is likely the best way to handle it as then Apache doesn't have to process that traffic at all on your system.
    0
  • tagteam
    I blocked it in the morning and around 11:30. Then an hour later I see: 144.91.125.96 - - [08/Dec/2020:11:34:55 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-03-04&paged=6 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 144.91.125.96 - - [08/Dec/2020:11:35:04 -0600] "GET /page/6/?post_type=tribe_events&eventDisplay=day&eventDate=2016-03-04 HTTP/1.1" 200 31372 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 167.114.157.181 - - [08/Dec/2020:12:38:38 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 167.114.64.97 - - [08/Dec/2020:12:40:37 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 167.86.74.24 - - [08/Dec/2020:13:12:53 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 167.114.157.181 - - [08/Dec/2020:13:18:14 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 148.251.9.145 - - [08/Dec/2020:15:18:52 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 192.99.4.168 - - [08/Dec/2020:15:23:47 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" 85.165.52.41 - - [08/Dec/2020:15:33:11 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)" So it looks like, maybe now they are stopping at the robots.txt and not scanning. Is that what I am seeing going on here?
    0
  • cPRex Jurassic Moderator
    That's also how I'd interpret that - they are seeing robots.txt, but then no other GET requests to other pages of the site.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post