AH01075: Error dispatching request to : (polling)

[Wed May 21 00:34:42.824943 2025] [proxy_fcgi:error] [pid 296120:tid 296160] (70007)The timeout specified has expired: [client xxx:43672] AH01075: Error dispatching request to : (polling)

Connection refused: AH02454: FCGI: attempt to connect to Unix domain socket /opt/alt/php-fpm82/usr/var/sockets/domain.sock (localhost:8000) failed

AH01079: failed to make connection to backend: localhost

I Get this error EVERY night at around 00-02 the only way to get the page up again is by restarting the php-fpm service.

All other sites on the server are online only 1 page goes down. i cant figure out what causes this. Any ideas?

What is using it? WP? Another CMS? There should be some tuning you could do for it.
A kludge workaround would be to restart php-fpm82 shortly after the timeframe you are observering (nightly at 00:15).

yes, but 2 hours downtime every night isnt that good.
The site is using wordpress

is there anything i can easily fix?
I nave number of processes set at 200 and increased all other settings in the package and admin panel. still stops that one site every night

A user account won't be able to access 'localhost' with CWP security setup.

I would look at the script trying to run at that time, and maybe try your domain name instead of 'localhost'.
If that fails, maybe reach out to whoever that script belongs to for a suggestion.

Have you looked at the per-user tuning available under that version of php-fpm?
/opt/alt/php-fpm82/usr/etc/php-fpm.d/users/username.conf

Code: [Select]

pm = ondemand
pm.max_children = 4
pm.max_requests = 4000
pm.process_idle_timeout = 15s

;listen.backlog = -1
;request_terminate_timeout = 0s
rlimit_files = 131072
rlimit_core = unlimited
catch_workers_output = yesAdditionally/alternately, you could tune the particular vhost conf to include various FastCGI parameters that could help mitigate your issue. Here is what I have on a demanding Drupal site under Nginx:

Code: [Select]

        fastcgi_pass unix:/opt/alt/php-fpm82/usr/var/sockets/username.sock;
        fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
        try_files $fastcgi_script_name =404;
        fastcgi_index    update.php;
        include              fastcgi_params;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
        # Block httpoxy attacks. See https://httpoxy.org/.
        fastcgi_param HTTP_PROXY "";
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_intercept_errors on;

[Wed May 21 00:34:42.824943 2025] [proxy_fcgi:error] [pid 296120:tid 296160] (70007)The timeout specified has expired: [client xxx:43672] AH01075: Error dispatching request to : (polling)

Connection refused: AH02454: FCGI: attempt to connect to Unix domain socket /opt/alt/php-fpm82/usr/var/sockets/domain.sock (localhost:8000) failed

AH01079: failed to make connection to backend: localhost

I Get this error EVERY night at around 00-02 the only way to get the page up again is by restarting the php-fpm service.

All other sites on the server are online only 1 page goes down. i cant figure out what causes this. Any ideas?

A simple restart on your php-fpm server, while serving pages, can cause these messages.

A restart on your php-fpm server can occur if you run a cron process restarting the server at that time, or, for example, if you set a rebuild in the CWP configuration that did not complete.

Check the cron logs (/var/log/cron) at that time to see if there is a process restarting your php-fpm around that time.

Regards,

Netino

The problem isnt with phpfpm restarting @netino. It is something else.
cron logs:

Code: [Select]

May 23 01:00:01 server CROND[1626337]: (root) CMD (/etc/cxs/cxsdbupdate.pl > /dev/null 2>&1)
May 23 01:00:01 server CROND[1626336]: (root) CMD (/usr/local/cwp/php/bin/php -d disable_functions="" /usr/local/softaculous/do_backups.php >> /dev/null 2>&1)
May 23 01:00:01 server CROND[1626335]: (root) CMD (/usr/local/bin/svcMonitor)
May 23 01:00:01 server CROND[1626338]: (root) CMD (/usr/local/bin/svcMonitor-systemd)
May 23 01:00:01 server CROND[1626339]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
May 23 01:01:01 server CROND[1626733]: (root) CMD (run-parts /etc/cron.hourly)
May 23 01:01:01 server run-parts[1626736]: (/etc/cron.hourly) starting 0anacron
May 23 01:01:01 server anacron[1626742]: Anacron started on 2025-05-23
May 23 01:01:01 server anacron[1626742]: Normal exit (0 jobs run)
May 23 01:01:01 server run-parts[1626744]: (/etc/cron.hourly) finished 0anacron
May 23 01:05:01 server CROND[1627898]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
May 23 01:05:01 server CROND[1627897]: (root) CMD (/usr/local/cwp/php/bin/php -d disable_functions="" /usr/local/softaculous/do_backups.php >> /dev/null 2>&1)
May 23 01:10:01 server CROND[1629712]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
May 23 01:10:01 server CROND[1629714]: (root) CMD (/etc/cxs/cxsdbupdate.pl > /dev/null 2>&1)
May 23 01:10:01 server CROND[1629713]: (root) CMD (/usr/local/cwp/php/bin/php -d disable_functions="" /usr/local/softaculous/do_backups.php >> /dev/null 2>&1)
May 23 01:15:01 server CROND[1631415]: (root) CMD (/usr/local/bin/svcMonitor)
May 23 01:15:01 server CROND[1631416]: (root) CMD (/usr/local/cwp/php/bin/php -d disable_functions="" /usr/local/softaculous/do_backups.php >> /dev/null 2>&1)
May 23 01:15:01 server CROND[1631417]: (root) CMD (/usr/local/bin/svcMonitor-systemd)
May 23 01:15:01 server CROND[1631418]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
May 23 01:15:01 server CROND[1631459]: (root) CMD (/scripts/restart_phpfpm)
Uptimerobot says site was down at  01:12:34 but it has a 5 minute interval.
So it can be down from 01:07.

In accesslog the last line with http 200 code is this:
[23/May/2025:01:08:23 +0200] "POST /wp-admin/admin-ajax.php HTTP/2.0" 200

The first with a 504 error is this
Could it be a crawler taking down the site?

[23/May/2025:01:07:58 +0200] "GET /robots.txt HTTP/1.1" 504 247 "-" "Mozilla/5.0 (compatible; SemrushBot-BA; +http://www.semrush.com/bot.html)"

The problem isnt with phpfpm restarting @netino. It is something else.
cron logs:
(...)
Uptimerobot says site was down at  01:12:34 but it has a 5 minute interval.
So it can be down from 01:07.

Yeah, it doesn't seem to be something triggered by cron. I see you have CXS, but I don't know what the /etc/cxs/cxsdbupdate.pl script does, it would be good to check.

In accesslog the last line with http 200 code is this:
[23/May/2025:01:08:23 +0200] "POST /wp-admin/admin-ajax.php HTTP/2.0" 200

The first with a 504 error is this
Could it be a crawler taking down the site?

Is it your web server that goes down? If that's the case, you need to check the log in the file '/usr/local/apache/logs/error_log' around that time.
The AH01075 error doesn't seem to be related to this web server crash, because it's a very common error, and I have dozens of them on my server, and it has never crashed because of this error in 8 years.

[23/May/2025:01:07:58 +0200] "GET /robots.txt HTTP/1.1" 504 247 "-" "Mozilla/5.0 (compatible; SemrushBot-BA; +http://www.semrush.com/bot.html)"

Yes, this is a bot, but I don't think it can take down a server unless your server is already overloaded. It will make a lot of connections, and if the server is already overloaded, it could crash.

Most likely, your web server has already experienced problems, and simply can't serve the page.

According to the website <https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/504>:
"The HTTP 504 Gateway Timeout server error response status code indicates that the server, while acting as a gateway or proxy, did not receive a response in time from the upstream server in order to complete the request. This is similar to a 502 Bad Gateway, except that in a 504 status, the proxy or gateway did not receive any HTTP response from the origin within a certain time.

There are many causes of 504 errors, and fixing such problems likely requires investigation and debugging by server administrators, or the site may work again at a later time. Exceptions are client networking errors, particularly if the service works for other visitors, and if clients use VPNs or other custom networking setups. In such cases, clients should check network settings, firewall setup, proxy settings, DNS configuration, etc."

But there are other possibilities:
web server built and compiled with error;
customization on your web server;
Server configured with low resources;
Kernel customized/compiled with error;
etc.

Ideally, you should also check your log /var/log/messages around that time.

Likely culprits are MalwareDetect or the Softaculous backup routine that ran just before the crash. But given that it only affects one site and one version of PHP (and not the whole server), that would be the best place to investigate. Look at what that client is running (loaded WP install with auto-backups or cron tasks?) and that version of php-fpm see if there is something loading the server at that time or if you could do some tuning on php-fpm 8.2 specifically.