High mysql CPU usage after removal of wordfence

Keywords: WordPress - AWS - Technical issue - Other
bnsupport ID: c8eb6cc5-348b-a02b-bc91-cbd99b54fba1
Description:
Recently I uninstalled Wordfence, which for some unexplainable reason led my website to become very slow, often responding with 504. From the top-command I can see that mysql process is eating up all CPU - almost 100% constantly. I therefore checked my mysql log which looks the following:

2021-06-08T12:46:11.749482Z 0 [System] [MY-010116] [Server] /opt/bitnami/mysql/bin/mysqld.bin (mysqld 8.0.18) starting as process 1974
2021-06-08T12:46:13.084789Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2021-06-08T12:46:13.132862Z 0 [System] [MY-010931] [Server] /opt/bitnami/mysql/bin/mysqld.bin: ready for connections. Version: '8.0.18'  socket: '/opt/bitnami/mysql/tmp/mysql.sock'  port: 3306  MySQL Community Server - GPL.
2021-06-08T12:46:13.238488Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Socket: '/tmp/mysqlx.sock' bind-address: '::' port: 33060
2021-06-08T12:53:46.275699Z 0 [System] [MY-010910] [Server] /opt/bitnami/mysql/bin/mysqld.bin: Shutdown complete (mysqld 8.0.18)  MySQL Community Server - GPL.
2021-06-08T12:53:51.575813Z 0 [System] [MY-010116] [Server] /opt/bitnami/mysql/bin/mysqld.bin (mysqld 8.0.18) starting as process 3005
2021-06-08T12:53:52.479861Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2021-06-08T12:53:52.523542Z 0 [System] [MY-010931] [Server] /opt/bitnami/mysql/bin/mysqld.bin: ready for connections. Version: '8.0.18'  socket: '/opt/bitnami/mysql/tmp/mysql.sock'  port: 3306  MySQL Community Server - GPL.
2021-06-08T12:53:52.595122Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Socket: '/tmp/mysqlx.sock' bind-address: '::' port: 33060
2021-06-08T14:09:03.692717Z 0 [Warning] [MY-010909] [Server] /opt/bitnami/mysql/bin/mysqld.bin: Forcing close of thread 377  user: 'root'.
2021-06-08T14:09:04.519997Z 0 [System] [MY-010910] [Server] /opt/bitnami/mysql/bin/mysqld.bin: Shutdown complete (mysqld 8.0.18)  MySQL Community Server - GPL.
2021-06-08T14:09:11.821076Z 0 [System] [MY-010116] [Server] /opt/bitnami/mysql/bin/mysqld.bin (mysqld 8.0.18) starting as process 4697
2021-06-08T14:09:12.708524Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2021-06-08T14:09:12.750848Z 0 [System] [MY-010931] [Server] /opt/bitnami/mysql/bin/mysqld.bin: ready for connections. Version: '8.0.18'  socket: '/opt/bitnami/mysql/tmp/mysql.sock'  port: 3306  MySQL Community Server - GPL.
2021-06-08T14:09:12.844068Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Socket: '/tmp/mysqlx.sock' bind-address: '::' port: 33060
2021-06-08T14:10:17.085211Z 0 [System] [MY-010910] [Server] /opt/bitnami/mysql/bin/mysqld.bin: Shutdown complete (mysqld 8.0.18)  MySQL Community Server - GPL.
2021-06-08T14:10:21.001438Z 0 [System] [MY-010116] [Server] /opt/bitnami/mysql/bin/mysqld.bin (mysqld 8.0.18) starting as process 5407
2021-06-08T14:10:21.697966Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2021-06-08T14:10:21.723268Z 0 [System] [MY-010931] [Server] /opt/bitnami/mysql/bin/mysqld.bin: ready for connections. Version: '8.0.18'  socket: '/opt/bitnami/mysql/tmp/mysql.sock'  port: 3306  MySQL Community Server - GPL.
2021-06-08T14:10:21.876310Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Socket: '/tmp/mysqlx.sock' bind-address: '::' port: 33060
2021-06-08T14:14:02.141736Z 0 [System] [MY-010910] [Server] /opt/bitnami/mysql/bin/mysqld.bin: Shutdown complete (mysqld 8.0.18)  MySQL Community Server - GPL.
2021-06-08T14:14:05.832954Z 0 [System] [MY-010116] [Server] /opt/bitnami/mysql/bin/mysqld.bin (mysqld 8.0.18) starting as process 5845
2021-06-08T14:14:06.369093Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2021-06-08T14:14:06.394255Z 0 [System] [MY-010931] [Server] /opt/bitnami/mysql/bin/mysqld.bin: ready for connections. Version: '8.0.18'  socket: '/opt/bitnami/mysql/tmp/mysql.sock'  port: 3306  MySQL Community Server - GPL.
2021-06-08T14:14:06.551683Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Socket: '/tmp/mysqlx.sock' bind-address: '::' port: 33060
2021-06-08T14:24:37.878724Z 0 [System] [MY-010910] [Server] /opt/bitnami/mysql/bin/mysqld.bin: Shutdown complete (mysqld 8.0.18)  MySQL Community Server - GPL.
2021-06-08T14:24:41.753892Z 0 [System] [MY-010116] [Server] /opt/bitnami/mysql/bin/mysqld.bin (mysqld 8.0.18) starting as process 6340
2021-06-08T14:24:42.279293Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2021-06-08T14:24:42.305248Z 0 [System] [MY-010931] [Server] /opt/bitnami/mysql/bin/mysqld.bin: ready for connections. Version: '8.0.18'  socket: '/opt/bitnami/mysql/tmp/mysql.sock'  port: 3306  MySQL Community Server - GPL.
2021-06-08T14:24:42.460926Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Socket: '/tmp/mysqlx.sock' bind-address: '::' port: 33060
2021-06-08T14:36:08.841872Z 0 [System] [MY-010910] [Server] /opt/bitnami/mysql/bin/mysqld.bin: Shutdown complete (mysqld 8.0.18)  MySQL Community Server - GPL.
2021-06-08T14:36:13.172791Z 0 [System] [MY-010116] [Server] /opt/bitnami/mysql/bin/mysqld.bin (mysqld 8.0.18) starting as process 6902
2021-06-08T14:36:13.981763Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2021-06-08T14:36:14.027442Z 0 [System] [MY-010931] [Server] /opt/bitnami/mysql/bin/mysqld.bin: ready for connections. Version: '8.0.18'  socket: '/opt/bitnami/mysql/tmp/mysql.sock'  port: 3306  MySQL Community Server - GPL.
2021-06-08T14:36:14.134837Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Socket: '/tmp/mysqlx.sock' bind-address: '::' port: 33060```

So obviously, my mysql server starts over and over again, but I am not sure why?

I searched this forum for any possible source of this problem trying...
- to check if this related to bots attacking my site
- broken database 
- etc.

Do you have any idea?
Thank you!

Hi @jonathan.rhein,

That’s probably caused by a WordPress’ plugin. Can you disable all the plugins and see if the issue gets resolved? You can enable them one by one to investigate which one is causing the issue.

Apart from that, our support tool detected that your instance is running out of memory and that affects your instance’s performance. Can you try to increase the instance’s memory?

https://docs.bitnami.com/aws/faq/administration/change-server-type/

-----------------------------------
Display amount of free and used memory in the system
-----------------------------------
Running: free -m
In: /opt/bitnami

Output:

              total        used        free      shared  buff/cache   available
Mem:            990         582          71         111         336         103
Swap:           634         364         270

Did you take a look at our guide?

https://docs.bitnami.com/aws/apps/wordpress/troubleshooting/deny-connections-bots-apache/

Happy to help!


Was my answer helpful? Click on :heart:

Thank you @jota for your reply and help!

I have tried this already but it did not help…

I have upgraded the plan yesterday to the next level, but it did not help also. Our website ran totally fine up until the point where I deactivated and deleted Wordfence, Sucuri and malCure which I had actived to scan our site. Just after these plugins were removed the mysql process started to demand so much CPU. So I doubt it has something to do with increasing our Lightsail plan.

Yes, I did this and there was nothing suspicious. Again, I believe it has to do with the deactiaven and deletion of the above mentioned plugins as we did not have any performance issues before. Is there any evidence or known cases where disabling a plugin led to decrease in performance?

Thank you for your help!

This is a screen shot of our query monitor:

Why are these three queries soo slow?

and this it what it looks like in the frontend:

Hi @jonathan.rhein,

I suggest you check with the support team of those plugins to know if there is any leftovers of those plugins in the installation that is causing the performance problem.

No, we are not aware of any performance issue that is caused after disabling a plugin. The WordPress team may have more info though

https://wordpress.org/support/

It seems that those queries are triggered by a theme/plugin, the developers of those plugins may have more info about how to troubleshoot it.