This was a system service that ren every time the CPU spiked and logged what was running. Mostly it showed that php-fpm was what spiked the CPU. Fascinating.
daemon was at /etc/systemd/system/mk-cpu-watcher.service
[Unit]
Description=CPU Usage Watcher
After=network.target
[Service]
Type=simple
ExecStart=/usr/local/bin/mk-cpu-watcher.sh
Restart=always
[Install]
WantedBy=multi-user.target
script it ran was at /usr/local/bin/mk-cpu-watcher.sh
#!/bin/bash
LOG_FILE="/var/log/mk-cpu-spikes.log"
THRESHOLD=98 # Can set to threshold just below 100 to catch near-maximum usage
while true; do
CPU_USAGE=$(top -bn1 | grep "Cpu(s)" | awk '{print $2+$4}' | cut -d. -f1)
if [ "$CPU_USAGE" -ge "$THRESHOLD" ]; then
echo "=== CPU spike detected at $(date) - Usage: ${CPU_USAGE}% ===" >> "$LOG_FILE"
echo "Top processes:" >> "$LOG_FILE"
ps -eo pid,ppid,cmd,%cpu,%mem --sort=-%cpu | head -11 >> "$LOG_FILE"
echo -e "\n" >> "$LOG_FILE"
fi
sleep 5 # Check every 5 seconds
done
log was at /var/log/mk-cpu-spikes.log
