How to find what is maxing out my entry processes?

Question

My site has been going down due to the max number of Entry Processes being hit. Here's a screenshot from cPanel:

Looking into the Resource Usage Details, I'm seeing I/O and Entry Processes max out as well as a huge increase in CPU and Memory usage:

However, I've checked my access logs, and I don't have much web traffic going on when this happens, so I think it is a script of some kind causing this to happen, most likely a WordPress plugin. Is there a way (In WHM/cPanel) to figure out what scripts are actually running and causing this?

Web traffic

Check the web logs to see which pages are being requested. If they're hitting a single page with a bad plug-in then it should show you the Page/Request URI that the user hit. Some things like scripts that resize image uploads can eat resources quickly.

If you were getting a lot of traffic for the webserver then it would likely be someone exploiting the server with a botnet or something of that nature.

Bad web traffic

If you can't seem to determine which page it is on the site, try to use something like Google Webmaster tools to see if they can get to the site and what pages they're seeing. They may have a page indexed that someone is using for an exploit potentially (backdoor). You can search for site:example.com and they'll list all of the indexed pages.

Routine maintenance

Check to make sure that something like a CRON job isn't running that could run the box out of resources. Something that tars or gzips a lot of already compressed content could be the culprit as well. (eg. I had a graphic designer upload a 4gb iso to one of the servers I manage and it was bringing down a VPS during nightly back-ups.)

If you manage the server and can access the box with a command line terminal like SSH, you can run top from the command line and see what process is taking up the resources.

Other

If the server is under a DDoS attack or something of that nature it won't necessarily show up as web traffic because the physical server itself would be handling those requests with whatever the chosen port is. (eg. Someone says your webserver is the authoritative DNS server for something like non-existent-site.com and then floods your site with those requests the server will spend all of its time telling the other boxes that it's not the server they're looking for.)

If it is something like this, you can change the IP (maybe) or try to block the requests with something like iptables as a last resort attempt. This should really be done at the router further up the pipe though.

Comments

[Admin]

Is this Windows or Linux? Do you have access to the box via something like SSH? You might be able to run a command like top to see what's eating the processor resources.

[brentonstrine]

Thanks for this comprehensive answer, thanks to you I was able to trace it to wp_cron.php which gives me some clear next steps.

[AbsoluteƵERØ]

@brentonstrine Awesome.

[Shawn]

When a user streams or downloads a large file, does he occupy one entry process the whole time?