PHP5-FPM 在新的微实例上不断崩溃，日志为空白

Question

我对这一切都不熟悉，但无法让我新旋转的微型 ec2 服务器保持正常运行（运行 wordpress）。 PHP-FPM 日志仅具有此日志记录设置为调试。

[17-Oct-2016 15:46:38] NOTICE: configuration file /etc/php5/fpm/php-fpm.conf test is successful

我的 nginx 日志不断充满尝试连接到 php5-fpm.sock 的错误（即使没有其他人访问该站点，每分钟也有数百个条目）。

2016/10/17 16:32:16 [error] 26389#0: *7298 connect() to unix:/var/run/php5-fpm.sock failed (11: Resource temporarily unavailable) while connecting to upstream, client: 191.96.249.80, server: mysiteredacted.com, request: "POST /xmlrpc.php HTTP/1.0", upstream: "fastcgi://unix:/var/run/php5-fpm.sock:", host: "removed"

在重新启动 nginx 和 PHP-FPM 后，站点会运行几分钟，然后抛出 502 Bad Gateway 错误，直到我再次重新启动它们。

我不知道从哪里开始。这是我的 nginx 配置文件：

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;
    port_in_redirect off;
    gzip  on;
    gzip_types text/css text/xml text/javascript application/x-javascript;
    gzip_vary on;

    include /etc/nginx/conf.d/*.conf;
}

在/conf.d文件夹中也包含这个文件：

server {
    ## Your website name goes here.
    server_name mysiteredacted.com www.mysiteredacted.com;
    ## Your only path reference.
    root /var/www/;
    listen 80;
    ## This should be in your http block and if it is, it's not needed here.
    index index.html index.htm index.php;

    include conf.d/drop;

        location / {
                # This is cool because no php is touched for static content
            try_files $uri $uri/ /index.php?q=$uri&$args;
        }

        location ~ \.php$ {
            fastcgi_buffers 8 256k;
            fastcgi_buffer_size 128k;
            fastcgi_intercept_errors on;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            # fastcgi_pass unix:/dev/shm/php-fpm-www.sock;
            fastcgi_pass unix:/var/run/php5-fpm.sock;

        }

        location ~* \.(css|js|png|jpg|jpeg|gif|ico)$ {
                expires 1d;
        }
}

Answer 1

第二个文件有这一行：

fastcgi_pass unix:/var/run/php5-fpm.sock;

如果该文件不存在，它将引发此错误。

查看上一个问题：How to find my php-fpm.sock?

Answer 2

经过数小时的搜索，我终于弄明白了。事实证明，这是对 /xmlrpc.php 的某种蛮力攻击，如“POST /xmlrpc.php HTTP/1.0”的数千个请求所示。

这是一种常见的 WordPress 攻击。谢谢大家。