The following processes with the long lifetime (started by the Plesk Daily Maintenance task) are stuck and consume a lot of CPU (up to 100%) or RAM (there can be one or more such processes):
In Plesk for Linux:
# ps aux | grep safe_mode | grep -v grep
user+ 812014 203.0.113.2 347652 21328 ? R 00:01 728:37 /opt/plesk/php/7.0/bin/php -d safe_mode=off -d display_errors=off -d opcache.enable_cli=off -d open_basedir= -c /var/www/vhosts/system/example.com/etc/php.ini /usr/local/psa/admin/plib/modules/wp-toolkit/vendor/wp-cli/wp-cli/bin/../php/boot-fs.php –path=/var/www/vhosts/example.com/httpdocs instance info –format=json –check-updates=true –quiet
In Plesk for Windows, similar processes can be found in the Task Manager (or Process Explorer).
The following lines are found in the file
index.phpin the domain’s directory:
# less /var/www/vhosts/example.com/instancename/wp-config.php
Note: Use PHP Decode to decrypt the line above. It will return the location of the malware.
The following error can be found in the file
ERR [extension/wp-toolkit] Unable to process WordPress instance #34.
Plesk WP Toolkit fails to be opened with 502 error.
#EXTWPTOOLK-1524 “WP Toolkit no longer hangs during the execution of routine daily maintenance tasks when it encounters WordPress instances infected by malware or otherwise operationally challenged.”
- WP Toolkit 3.5.0 29 November 2018
Make sure that Plesk is up to date and check that extension is up to date too.
In case the process was spawned by the UI/API/CLI, or the WP Toolkit cannot be updated, apply the solution from the following article: Low server performance: WP Toolkit processes spawned by UI/API/CLI are stuck