Preloader
Performance & Security

Xtream UI High CPU Solution - Step by Step Guide

Diagnose CPU spikes, detect compromised processes, and optimize your streaming stack.

Stop Guessing, Start Measuring

High CPU usage on an Xtream UI server usually stems from the specific stack components: FFmpeg (transcoding), PHP-FPM (panel requests), or MySQL (database queries). Occasionally, it indicates a security compromise (cryptominers). This guide provides a systematic workflow to identify and fix the root cause.

1Step 1: Diagnosis - What is Burning CPU?

Before applying fixes, pinpoint the exact process. Run these commands to get a clear picture.

See per-core usage:

mpstat -P ALL 1 5

Identify top CPU process:

top -o %CPU # OR ps aux --sort=-%cpu | head -n 20

At this point, you should know if the culprit is ffmpeg, php-fpm, mysqld, or a suspicious unknown process.

2Step 2: Security Check (Unknown Processes)

If you see a process consuming 80-100% CPU with a random name, assume a compromise (miner). IPTV panels are frequent targets.

Inspect the process: (Replace PID with the process ID)

PID=12345 ps -p $PID -o pid,ppid,user,%cpu,%mem,etime,cmd readlink -f /proc/$PID/exe lsof -p $PID | head

Check for persistence (how it restarts):

crontab -l sudo ls -la /etc/cron.* /etc/crontab systemctl list-timers --all

Action: If malicious, isolate the server, kill the process, remove the cron job/service, and ideally rebuild the server from a clean backup.

3Step 3: Fix PHP-FPM Spikes

If php-fpm is the top consumer, it is often due to abusive traffic (bots) or poor configuration.

A) Check for floods:

sudo tail -n 200 /var/log/nginx/access.log

B) Tune Pool Sizing:
If pm.max_children is too low, requests queue up causing latency. If too high, RAM swaps, causing CPU wait. Adjust pm.max_children in your pool config based on available RAM.

C) Enable OPcache:
Ensure PHP OPcache is enabled in your php.ini. This significantly reduces CPU usage by caching compiled script bytecode.

4Step 4: Optimize Database (MySQL/MariaDB)

If mysqld is eating CPU, it's usually scanning tables efficiently.

  • Enable Slow Query Log: Find queries taking longer than 1-2 seconds.
  • Indexing: Add indexes to columns used frequently in WHERE clauses.
  • Buffer Pool: Ensure innodb_buffer_pool_size is adequate (but not starving the OS) to reduce disk I/O churn which drives up CPU wait times.

5Step 5: Taming FFmpeg

FFmpeg is naturally CPU intensive. If it is the bottleneck:

  • Cap Concurrency: Do not allow unlimited concurrent transcodes.
  • Use Faster Presets: Change encoding preset to veryfast or superfast. This trades a bit of quality/bitrate efficiency for significantly lower CPU usage.
  • Hardware Acceleration: If your server supports it (Intel QSV or NVIDIA NVENC), ensure your FFmpeg build utilizes it to offload tasks from the CPU.

Summary Cheat Sheet

  • CPU = ffmpeg → Reduce complexity, use 'fast' presets, enable HW accel.
  • CPU = php-fpm → Rate limit Nginx, tune pm.max_children, enable OPcache.
  • CPU = mysqld → Check slow query log, add indexes, tune buffer pool.
  • CPU = random process → Check crontab and systemd, likely malware.