yesterday my server load went up to 90, the average is usually around 1. also my processes went up to 500, the average is usually 80. how can if figure out what was going on when that happened (what all those processes were)? my visitor and pages viewed numbers were average for the day.

this is my log file...

Dec 2 10:00:09 server1 thttpd[3322]: up 439200 seconds, stats for 3600 seconds:
Dec 2 10:00:09 server1 thttpd[3322]: thttpd - 1647 connections (0.4575/sec), 8 max simultaneous, 13755448 bytes (3820.96/sec), 17 httpd_conns allocated
Dec 2 10:00:09 server1 thttpd[3322]: libhttpd - 228 strings allocated, 101906 bytes (446.956 bytes/str)
Dec 2 10:00:09 server1 thttpd[3322]: map cache - 50 allocated, 49 active (485802 bytes), 1 free; hash size: 1024; expire age: 1800
Dec 2 10:00:09 server1 thttpd[3322]: fdwatch - 7495 polls (2.08194/sec)
Dec 2 10:00:09 server1 thttpd[3322]: timers - 3 allocated, 3 active, 0 free
Dec 2 10:19:02 server1 thttpd[3322]: 81.xxx.104.23 URL "/" tried to index a directory
Dec 2 10:50:29 server1 thttpd[3322]: 137.xxx.250.100 connection timed out sending
Dec 2 10:50:29 server1 last message repeated 2 times
Dec 2 11:00:04 server1 thttpd[3322]: 142.xxx.173.93 connection timed out reading


it seems that the spike occurred around this time "Dec 2 10:19:02 server1 thttpd[3322]: 81.xxx.104.23 URL "/" tried to index a directory"

so i wonder if that was the problem, and why it was a problem.

I don't know much about thttpd, but you do need to make sure you set limits on all services that fork processes. The quickest and easiest way to bring your system down is through forking a lot of processes, which will quickly use up any and all available memory.

You should be sure that all services have limits specified on how many processes can be spawned. You'll need to check the documentation on thttpd to find out how to set this limit.

<<Signature to be setup in your profile>>

but the amount of thttp processes was the same during the spike as it generally is.

Is this a single processor server or is it a dual proc? If you only have one processor your running way too close to full.

What do you mean by "your processes when up to 500"? Do you mean your total number of processes went from 80 to 500? If so that is the problem you need to run ps -aux and see what is taking up that many processes. It might be somebody trying to ddos you by attacking the webserver but since it spikes up and down that is probably not the issue.

i have a single processor, why am i running way too close to full? the cpu never broke 40% during the load/process spike.

i just installed thttpd the other day because i heard it was served images far more efficiently than apache, so it may be the cause of my problems.

yes total number of processes when up to 500 according to webmin stats, it stayed like that for 10 minutes then went back to normal (normal being around 80 processes). it has not happended since.

With a single processor system you do not want the loads to exceed 1 by very much. If you are running at 1 all of the time you are just waiting for disaster when a load spike happens.

As far as what was causing it, run ps -aux and see what is process has so many children.