Recently, the website soared to 100% CPU easily jammed, thought that is not enough resources, from 4 up to 8 kernel, but still so,
Through the study found that "work in progress" in the open IIS, found a POST request in connection, and will always be connected, unless to restart IIS or recycle the application pool, otherwise, the w3wp. Exe that process will have been increased to 100% CPU card die, (below)


Then check the IIS log found that should be scanned by the injection of software, is all some file does not exist, log also show that in 404, but just don't understand why always request don't interrupt! (below)


First think a stupid way is to recycle the application pool, but it doesn't work, because the request will suddenly appear, and then in a relatively short period of time to let the CPU full, installed security dog is useless, security dogs think this is normal post request, will not intercept, IP blacklist is useless, for scanning of IP change every day, and may have to, do me a favor

CodePudding user response:

PHP revise request and returns the result

CodePudding user response:

Add token