There's thousands of requests like the one below - almost 4 a second.
Code: Select all
69.197.x.x - - [05/Dec/2017:05:12:53 +0000] "POST /xmlrpc.php HTTP/1.0" 200 926 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
NixStats had Apache's memory usage at ~93%. Server has 2GB of RAM.
When I blocked the IP, the requests immediately stopped and so did the bot's connection attempts.
Apache's memory usage however did not come down.
I monitored it for 30 mins and am certain that the offending IP or any other IP did was not attempting to connect, but memory usage still did not come down.
I had to restart Apache for it to free up all the RAM it was using.
If there are no requests, why didn't apache's memory usage come down on it's own?