Question

我对这一切都很陌生，但不能保持我新开的微型ec2服务器正常运行（运行wordpress）。 PHP-FPM日志只有将日志记录设置为debug。

[17-Oct-2016 15:46:38] NOTICE: configuration file /etc/php5/fpm/php-fpm.conf test is successful

我的nginx日志不断填写错误，试图连接到php5-fpm.sock（即使没有其他人访问该站点，每分钟也有数百个条目）。

2016/10/17 16:32:16 [error] 26389#0: *7298 connect() to unix:/var/run/php5-fpm.sock failed (11: Resource temporarily unavailable) while connecting to upstream, client: 191.96.249.80, server: mysiteredacted.com, request: "POST /xmlrpc.php HTTP/1.0", upstream: "fastcgi://unix:/var/run/php5-fpm.sock:", host: "removed"

重新启动nginx和PHP-FPM之后，网站会运行几分钟，然后再抛出502 Bad Gateway错误，直到我再次重启它们为止。

我不知道从哪里开始。这是我的nginx配置文件：

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;
    port_in_redirect off;
    gzip  on;
    gzip_types text/css text/xml text/javascript application/x-javascript;
    gzip_vary on;

    include /etc/nginx/conf.d/*.conf;
}

其中还包含/conf.d文件夹中的此文件：

server {
    ## Your website name goes here.
    server_name mysiteredacted.com www.mysiteredacted.com;
    ## Your only path reference.
    root /var/www/;
    listen 80;
    ## This should be in your http block and if it is, it's not needed here.
    index index.html index.htm index.php;

    include conf.d/drop;

        location / {
                # This is cool because no php is touched for static content
            try_files $uri $uri/ /index.php?q=$uri&$args;
        }

        location ~ \.php$ {
            fastcgi_buffers 8 256k;
            fastcgi_buffer_size 128k;
            fastcgi_intercept_errors on;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            # fastcgi_pass unix:/dev/shm/php-fpm-www.sock;
            fastcgi_pass unix:/var/run/php5-fpm.sock;

        }

        location ~* \.(css|js|png|jpg|jpeg|gif|ico)$ {
                expires 1d;
        }
}

Answer 1

第二个文件有这一行：

fastcgi_pass unix:/var/run/php5-fpm.sock;

如果该文件不存在，则会抛出此错误。

检查上一个问题：How to find my php-fpm.sock?

Answer 2

经过几个小时的搜索，我终于弄明白了。原来这是对/xmlrpc.php的某种暴力攻击，如“POST /xmlrpc.php HTTP / 1.0”的数千个请求所示。

这是一种常见的WordPress攻击。谢谢大家。

PHP5-FPM在新的微实例上不断崩溃，日志为空

2 个答案: