My site has been going down due to the max number of Entry Processes being hit. Here's a screenshot from cPanel:

20 of 20 Entry Processes being used

Looking into the Resource Usage Details, I'm seeing I/O and Entry Processes max out as well as a huge increase in CPU and Memory usage:

enter image description here

However, I've checked my access logs, and I don't have much web traffic going on when this happens, so I think it is a script of some kind causing this to happen, most likely a WordPress plugin. Is there a way (In WHM/cPanel) to figure out what scripts are actually running and causing this?

  • 1
    Is this Windows or Linux? Do you have access to the box via something like SSH? You might be able to run a command like top to see what's eating the processor resources. Aug 12, 2013 at 20:44

1 Answer 1


Web traffic

Check the web logs to see which pages are being requested. If they're hitting a single page with a bad plug-in then it should show you the Page/Request URI that the user hit. Some things like scripts that resize image uploads can eat resources quickly.

If you were getting a lot of traffic for the webserver then it would likely be someone exploiting the server with a botnet or something of that nature.

Bad web traffic

If you can't seem to determine which page it is on the site, try to use something like Google Webmaster tools to see if they can get to the site and what pages they're seeing. They may have a page indexed that someone is using for an exploit potentially (backdoor). You can search for site:example.com and they'll list all of the indexed pages.

Routine maintenance

Check to make sure that something like a CRON job isn't running that could run the box out of resources. Something that tars or gzips a lot of already compressed content could be the culprit as well. (eg. I had a graphic designer upload a 4gb iso to one of the servers I manage and it was bringing down a VPS during nightly back-ups.)

If you manage the server and can access the box with a command line terminal like SSH, you can run top from the command line and see what process is taking up the resources.


If the server is under a DDoS attack or something of that nature it won't necessarily show up as web traffic because the physical server itself would be handling those requests with whatever the chosen port is. (eg. Someone says your webserver is the authoritative DNS server for something like non-existent-site.com and then floods your site with those requests the server will spend all of its time telling the other boxes that it's not the server they're looking for.)

If it is something like this, you can change the IP (maybe) or try to block the requests with something like iptables as a last resort attempt. This should really be done at the router further up the pipe though.

  • 3
    Thanks for this comprehensive answer, thanks to you I was able to trace it to wp_cron.php which gives me some clear next steps. Aug 12, 2013 at 21:47
  • @brentonstrine Awesome. Aug 12, 2013 at 21:52
  • When a user streams or downloads a large file, does he occupy one entry process the whole time?
    – Shawn
    Oct 6, 2016 at 16:46
  • @Shawn start a new question. This gets pretty deep. Oct 12, 2016 at 18:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.