AWS Server Crashing

stoi2m1 2018-11-12 18:38:33 UTC #1

Keywords: LAMP/MAMP/WAMP - AWS - Technical issue - Other
bnsupport ID: 9c08fee9-9733-b770-6e8c-e3c4327f1b45
Description:
At some point over the last 2 weeks something has happened to my server. It becomes unresponsive to browser requests and sequentially becomes unresponsive to SSH, FTP and ping requests as well. The only resolution I have been able to find to this point is rebooting the instance.

The first time this happened I still had SSH access. I check for free memory and free hard drive space and both seemed to have substantial space.

Today I was unable to SSH so I was unable to determine these same conditions.

Can you give me any advice as to where to look and what to look for as being part of my issue?

Thanks,
Jesse

jota 2018-11-13 10:25:05 UTC #2

Hi @stoi2m1,

Thank you for using Bitnami, can you follow the instructions of this section of our documentation? It shows different commands to obtain more information to troubleshoot server performance issues

https://docs.bitnami.com/aws/how-to/troubleshoot-wordpress-issues/#is-your-installation-slow

Thanks

stoi2m1 2018-11-19 16:49:19 UTC #4

I went through the suggested page for top 10 ip address and server performance. The list below are my results.

CPU usage: Monitoring in the dashboard shows max at about 17%

RAM usage: results from using the free command
                             total         used      free        shared    buffers    cached
Mem:                    1016280  730176  286104  38052     73844     294320
-/+ buffers/cache: 362012    654268
Swap:                   649996    105848  544148

disk space used: result from df / - 56%

using cache - some is still enabled, most is disabled, using S3

I get top 10 ip address, but when I ran the cat access log command I got an error:
cat access_log | grep xxx.xxx.xxx.xxx
cat: access_log: No such file or directory

Please Advise, Thanks,
Jesse

tomasp 2018-11-20 08:58:22 UTC #5

HI @stoi2m1,

The command:

cat access_log | grep IP_ADDRESS

should be

cat /opt/bitnami/apache2/logs/access_log | grep IP_ADDRESS

So it uses the absolute path to the file and you can execute it from each directory.

stoi2m1 2018-11-25 03:20:02 UTC #6

OK, I ran the command on the 10 IP address and each of them are running either a POST or a GET against xmlrpc.php.

Between those 10 IP Addresses there are about 7400 logs. and they all look like this.
xxx.xxx.xxx.xxx - - [24/Nov/2018:23:06:19 +0000] "POST /xmlrpc.php HTTP/1.1" 302 228
xxx.xxx.xxx.xxx - - [24/Nov/2018:23:05:19 +0000] "GET /xmlrpc.php HTTP/1.1" 405 42

The numbers at the end very, I am not sure what they mean. Sometimes they end in "200 210". From all of the request being the same file it seems like some sort of attack on the site. Any suggestions? Should I seek further help from the WordPress community or can you still help me? If you can not help me any longer can you point me in the direction of what is happening and how to phrase the issue and what kind of help I need?

Thanks,
Jesse

tomasp 2018-11-26 08:18:29 UTC #7

Hello @stoi2m1,

You can try blocking all requests from those suspicious IPs following these instructions

system 2018-12-10 08:18:32 UTC #8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!