Results 1 to 13 of 13
-
08-09-2007, 09:45 PM #1Newbie
- Join Date
- Nov 2005
- Posts
- 25
Daily, time to time cpu load problem
I have a dedicated server specs: AMD 3500+ 64 Bit CPU, 1 GB Ram, 160 GB Sata Drive. For 1 month, CPU load average reaches 40-50 value. This happens about 5-6 times in a day. When I stop httpd service for 30 seconds everything goes normal. I think this is not a DoS attack because it comes systematic, I dont believe no one makes this regularly except bots.
Maybe its a system service or a cronjob but it stops when I turn off httpd service?
How can I be sure about what's making this regularly load?
I also did set up a script which mail me when load average of system goes crazy and restart httpd service. But instant restart is not working to stop load increase. Any idea to stoping and delaying 30 seconds before restart a service.
I need to figure out this problem please help me to find out.
-
08-09-2007, 09:49 PM #2Web Hosting Master
- Join Date
- May 2003
- Posts
- 1,151
Well at least you figured out it's http related.
How many sites do you host on this server?
Turn http back on and look at the logs, it can easily be a DoS (http being the service)Datums Internet Solutions, LLC
Systems Engineering & Managed Hosting Services
Complex Hosting Consultants
-
08-09-2007, 10:10 PM #3Newbie
- Join Date
- Nov 2005
- Posts
- 25
3 sites with high traffic in it.
Which log do you mean apache dom logs or error logs?
Got logs in: apache/logs/ and apache/domlogs/ and what I am going to investigate?
-
08-09-2007, 10:21 PM #4Web Hosting Master
- Join Date
- May 2003
- Posts
- 1,151
if cpanel /usr/local/apache/domlogs
see which of the 3 is getting the most traffic, do you have any hotlinking protection ? are these media/entertainment sites?Datums Internet Solutions, LLC
Systems Engineering & Managed Hosting Services
Complex Hosting Consultants
-
08-09-2007, 10:36 PM #5Newbie
- Join Date
- Nov 2005
- Posts
- 25
There is one image hosting site but it has hotlinking protection for images folder not for the thumbnail folder.
I think if its the reason, why only 5 or 6 times stresses the server?
-
08-09-2007, 10:52 PM #6Web Hosting Master
- Join Date
- May 2003
- Posts
- 1,151
I don't know if it's the reason, just making a suggestion. Put your alert to send you an email when the load is at 10, so you can take a look as it's happening.
Datums Internet Solutions, LLC
Systems Engineering & Managed Hosting Services
Complex Hosting Consultants
-
08-11-2007, 01:17 AM #7Web Hosting Master
- Join Date
- Nov 2004
- Location
- Australia
- Posts
- 1,737
Have you got anything that reacts to bots going wild or DOS attempts?
CSF works well for that (see here) and mod_evasive may also help.
-
08-11-2007, 02:20 AM #8Newbie
- Join Date
- Nov 2005
- Posts
- 25
Yes I'm suspicous about search engine bots, sites got so many pages, one of these bots can make this load.
Thanks for the tip I got APF but now I set up CSF it seem more visional.
-
08-11-2007, 03:49 AM #9Web Hosting Master
- Join Date
- Nov 2004
- Location
- Australia
- Posts
- 1,737
Go into the config file and carefully tune the settings for blocking sites. (you can get to it through WHM).
The main difference between CSF and APF is that CSF is much better at blocking (apart from the interface and the regular updates of course).
-
08-11-2007, 07:08 AM #10Greece
- Join Date
- Jan 2004
- Location
- Greece
- Posts
- 2,211
It sounds like you need more RAM or faster hard disk. Can you type top at console and paste here the output?
-
08-11-2007, 08:28 AM #11Newbie
- Join Date
- Nov 2005
- Posts
- 25
Here is the TOP screen when load starts:
img172.imageshack.us/img172/5236/top1yy6.jpg
A few minutes lates server load average goes 10:
img167.imageshack.us/img167/114/top2tz6.jpg
When I check log files I didnt see anything weird but actually I dont know what to investigate in it.
-
08-11-2007, 11:14 AM #12Web Hosting Master
- Join Date
- Nov 2004
- Location
- Australia
- Posts
- 1,737
-
08-11-2007, 11:19 AM #13Web Hosting Master
- Join Date
- Nov 2004
- Location
- Australia
- Posts
- 1,737
Right off the top of my head, you seem to have a lot of httpd processes running, perhaps too many. I'd set it down to 10 for a while and see how that goes, you might be getting thrashing when a lot of requests hit at once. It would be interesting to see the output of 2-3 minutes of "vmstat 5" while you were undergoing one of these performance spikes. Do that BEFORE changing the number of httpd processes, then after, so you can see the difference, and post both as plain text here for us as well.
Specifically what we're looking for here is a large "si" and "so" number - anything at all will mean a huge dive in performance.