Results 1 to 13 of 13
  1. #1

    Exclamation Daily, time to time cpu load problem

    I have a dedicated server specs: AMD 3500+ 64 Bit CPU, 1 GB Ram, 160 GB Sata Drive. For 1 month, CPU load average reaches 40-50 value. This happens about 5-6 times in a day. When I stop httpd service for 30 seconds everything goes normal. I think this is not a DoS attack because it comes systematic, I dont believe no one makes this regularly except bots.
    Maybe its a system service or a cronjob but it stops when I turn off httpd service?
    How can I be sure about what's making this regularly load?

    I also did set up a script which mail me when load average of system goes crazy and restart httpd service. But instant restart is not working to stop load increase. Any idea to stoping and delaying 30 seconds before restart a service.

    I need to figure out this problem please help me to find out.

  2. #2
    Well at least you figured out it's http related.
    How many sites do you host on this server?
    Turn http back on and look at the logs, it can easily be a DoS (http being the service)
    Datums Internet Solutions, LLC
    Systems Engineering & Managed Hosting Services
    Complex Hosting Consultants

  3. #3
    3 sites with high traffic in it.
    Which log do you mean apache dom logs or error logs?
    Got logs in: apache/logs/ and apache/domlogs/ and what I am going to investigate?

  4. #4
    if cpanel /usr/local/apache/domlogs

    see which of the 3 is getting the most traffic, do you have any hotlinking protection ? are these media/entertainment sites?
    Datums Internet Solutions, LLC
    Systems Engineering & Managed Hosting Services
    Complex Hosting Consultants

  5. #5
    There is one image hosting site but it has hotlinking protection for images folder not for the thumbnail folder.

    I think if its the reason, why only 5 or 6 times stresses the server?

  6. #6
    I don't know if it's the reason, just making a suggestion. Put your alert to send you an email when the load is at 10, so you can take a look as it's happening.
    Datums Internet Solutions, LLC
    Systems Engineering & Managed Hosting Services
    Complex Hosting Consultants

  7. #7
    Join Date
    Nov 2004
    Location
    Australia
    Posts
    1,737
    Have you got anything that reacts to bots going wild or DOS attempts?

    CSF works well for that (see here) and mod_evasive may also help.

  8. #8
    Yes I'm suspicous about search engine bots, sites got so many pages, one of these bots can make this load.
    Thanks for the tip I got APF but now I set up CSF it seem more visional.

  9. #9
    Join Date
    Nov 2004
    Location
    Australia
    Posts
    1,737
    Go into the config file and carefully tune the settings for blocking sites. (you can get to it through WHM).

    The main difference between CSF and APF is that CSF is much better at blocking (apart from the interface and the regular updates of course).

  10. #10
    Join Date
    Jan 2004
    Location
    Greece
    Posts
    2,211
    It sounds like you need more RAM or faster hard disk. Can you type top at console and paste here the output?

  11. #11
    Here is the TOP screen when load starts:
    img172.imageshack.us/img172/5236/top1yy6.jpg

    A few minutes lates server load average goes 10:
    img167.imageshack.us/img167/114/top2tz6.jpg

    When I check log files I didnt see anything weird but actually I dont know what to investigate in it.

  12. #12
    Join Date
    Nov 2004
    Location
    Australia
    Posts
    1,737
    Quote Originally Posted by McClickson View Post
    Here is the TOP screen when load starts:
    img172.imageshack.us/img172/5236/top1yy6.jpg

    A few minutes lates server load average goes 10:
    img167.imageshack.us/img167/114/top2tz6.jpg

    When I check log files I didnt see anything weird but actually I dont know what to investigate in it.
    The above as clickable links

  13. #13
    Join Date
    Nov 2004
    Location
    Australia
    Posts
    1,737
    Right off the top of my head, you seem to have a lot of httpd processes running, perhaps too many. I'd set it down to 10 for a while and see how that goes, you might be getting thrashing when a lot of requests hit at once. It would be interesting to see the output of 2-3 minutes of "vmstat 5" while you were undergoing one of these performance spikes. Do that BEFORE changing the number of httpd processes, then after, so you can see the difference, and post both as plain text here for us as well.

    Specifically what we're looking for here is a large "si" and "so" number - anything at all will mean a huge dive in performance.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •