tmp tasks of lsphp which installed by ols, take to much cpu

[Seyed Ali Roshan]

hello,
the tasks which lsphp (v 5.6.33) creates in /tmp with name of php + random-hash, take too much CPU of my server.
they also have a long uptime, for example, 16h (and still remains until I kill them).
when I kill one of them, the others will be gone too and cpu usage falls down to normal.
I also have a normal php version (v 7) which runs my phpmyadmin and it never takes too much cpu like that.

 

[Tishu]

Hello,

What is your config for the external app.

 

[Seyed Ali Roshan]

Hello,

What is your config for the external app.

 

[Tishu]

Hello again,

Can you check if the command setting is correct - check if there is file $SERVER_ROOT/fcgi-bin/lsphp-5.6.33. In most cases this will be only $SERVER_ROOT/fcgi-bin/lsphp

http://open.litespeedtech.com/mediawiki/index.php/Help:Default_PHP_Settings

 

[Seyed Ali Roshan]

Hello again,

Can you check if the command setting is correct - check if there is file $SERVER_ROOT/fcgi-bin/lsphp-5.6.33. In most cases this will be only $SERVER_ROOT/fcgi-bin/lsphp

http://open.litespeedtech.com/mediawiki/index.php/Help:Default_PHP_Settings

yes it exists
about the version,
I installed the 5.6.33 from the ols itself and changed the listener script to it

 

[Seyed Ali Roshan]

no answer?

 

[lskagan]

You can try adding Max Idle time of about 15 seconds. This will kill off idle PHP processes after 15 seconds.

 

[Seyed Ali Roshan]

You can try adding Max Idle time of about 15 seconds. This will kill off idle PHP processes after 15 seconds.

thanks for your help,
I'll test it

 

[Seyed Ali Roshan]

You can try adding Max Idle time of about 15 seconds. This will kill off idle PHP processes after 15 seconds.

unfortunately, the tasks are created under tmp folder still exist, and one of them is alive about 20h. even after putting what u said

 

[Tishu]

Hello again,

Can you check this proccess with:

lsof +p <PID>

 

[Seyed Ali Roshan]

Hello again,

Can you check this proccess with:

lsof +p <PID>

I will, sure

 

[Seyed Ali Roshan]

Hello again,

Can you check this proccess with:

lsof +p <PID>

 

[Tishu]

Hello again,

Can you post what its in this folder wordpress/fonts. By default there is no such dir in the wordpress root dir.

 

[Seyed Ali Roshan]

Hello again,

Can you post what its in this folder wordpress/fonts. By default there is no such dir in the wordpress root dir.

you are right, it's strange

 

[Tishu]

Hello again,

If this files are not from you .... your site may be hacked. You can install soft like maldet to ckeck and clean your site/sites.

 

[Seyed Ali Roshan]

Hello again,

If these files are not from you .... your site may be hacked. You can install soft like maldet to check and clean your site/sites.

I didn't build our site but I know my coworkers used a free template for it which had quickstart installer and also has not received any updates (wordpress itself and its plugins) for several months and I think maybe it's because of that.
there were some .php files in that folder contain the encoded strings and eval function, I removed them (the files) to see what will happen (site is still working and no strange task is running right now).
I have installed clamAV, does it do the trick or I should remove it and install maldet?

 

[Tishu]

Hello again,

My advice is to test with maldet too.

 

[Seyed Ali Roshan]

Hello again,

My advice is to test with maldet too.

Should I remove the clamAV or install maldet beside it?

 

[Seyed Ali Roshan]

unfortunately, these kinds of tasks still exist (you can see the result of lsof +p <PID> in below)

 

[Tishu]

Can you provide link to the page (here or on PM).

Maldet can work with clamAV, more information https://www.rfxn.com/projects/linux-malware-detect/