Results 1 to 19 of 19
Thread: high load ssh fails
-
11-11-2009, 06:41 AM #1Temporarily Suspended
- Join Date
- Mar 2008
- Posts
- 372
high load ssh fails
my friend has an vps, its having heavy loads
ram around 60%-90% used constantly currently and ssh fails
it gives - server unexpectedly closed network connection
can't login to ssh to check the load details and even error msg details
can any one guide on how to proceed
tried restarting server more than 5 times, but it goes to high load with in a minute time , so completely clueless on how to proceed
cent os - 5.3, DA, vsxpathaway, apache (latest stable release)
-
11-11-2009, 06:55 AM #2Disabled
- Join Date
- Apr 2009
- Posts
- 256
There can be n number of reasons for this. For a start, what you can do is login via SSH (if you can) and run the 'top' command to see which process(es) is eating up the resources and causing load.
Code:root@server# top -d2c
-
11-11-2009, 07:00 AM #3Temporarily Suspended
- Join Date
- Mar 2008
- Posts
- 372
actually ssh isn't getting in, tht's the major problem,
gives
server unexpectedly closed network connection
or
doesn't give any msg and never even asks for logins, just prompt opens with nothing in it
-
11-11-2009, 07:18 AM #4Disabled
- Join Date
- Apr 2009
- Posts
- 256
Ah okay. I thought that was an occasional problem and you might be able yo get in sometimes.
Do you have WHM access to the server wherein you can restart the services (apache,exim,mysql) which would bring down the load and then you can get in via SSH.
-
11-11-2009, 07:34 AM #5Web Hosting Master
- Join Date
- Nov 2004
- Location
- India
- Posts
- 1,104
It seems you are running short of resources, contact your host and ask them to increase the RAM.
AssistanZ - Beyond Boundaries...
Cloudstack Consultancy / 24x7 Web Hosting Support / 24x7 Server Management / Infrastructure Management Services
Web & Mobile Apps Development / Web Designing Services / Php, Grails, Java Development
-
11-11-2009, 07:42 AM #6Disabled
- Join Date
- Apr 2009
- Posts
- 256
If the problem has started suddenly out of nowhere then it is worth investigating the cause before increasing your resources. Of course, if you still cannot access the server then your host/datacenter would be in a better position to help.
-
11-11-2009, 07:51 AM #7Newbie
- Join Date
- Jun 2006
- Location
- Houston, Texas
- Posts
- 9
I suggest logging into DA and shutting down ALL services except sshd then logging into the server to start determining the root of the problem. Start each service one at a time to see where your issues are. Also I recommend installing rkhunter and chkrootkit to find any rootkits that may be linked directly to your issue. Look for hidden files and directories with lsof. If needed I am for hire and would be willing to help correct this issue with you.
-
11-11-2009, 08:06 AM #8Temporarily Suspended
- Join Date
- Mar 2008
- Posts
- 372
there is still free RAM available
have contacted the host, my friend is on un-managed plan so don't expect much out of them - to be frank
yes there is vxspathway and DA, I think I can restart services from DA, I tried restarting server several times by now
-
11-11-2009, 08:19 AM #9Disabled
- Join Date
- Apr 2009
- Posts
- 256
-
11-12-2009, 04:13 AM #10Disabled
- Join Date
- May 2009
- Location
- /home
- Posts
- 222
First of all restart apache and other services from directadmin and immediately get into server using ssh. After that check what service is consuming your more resources..If you notice you have many connections to 80 port. You should run 'iptraf' tool which is very handy to determine the connections consuming more resources.
-
11-12-2009, 06:05 AM #11Temporarily Suspended
- Join Date
- Mar 2008
- Posts
- 372
np carma, some how the site opened up with out restarting anything today, got load avgs from the hosting script itself, there is some prob still with "ssh", gives either access denied or server unexpectedly closed network connection
current loads:
top - 12:42:57 up 2:31, 0 users, load average: 0.10, 0.67, 1.00
Tasks: 215 total, 2 running, 213 sleeping, 0 stopped, 0 zombie
Cpu(s): 1.1%us, 0.9%sy, 0.0%ni, 98.0%id, 0.1%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 2097152k total, 705680k used, 1391472k free, 0k buffers
Swap: 0k total, 0k used, 0k free, 0k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
18037 apache 15 0 92960 7868 3120 S 3.9 0.4 0:00.73 httpd
29907 apache 15 0 12732 1232 836 R 3.9 0.1 0:00.03 top
18365 apache 15 0 92684 7948 3268 S 1.9 0.4 0:00.66 httpd
24070 apache 15 0 92960 5968 1552 S 1.9 0.3 0:00.23 httpd
24084 apache 15 0 92552 5572 1376 S 1.9 0.3 0:00.30 httpd
24150 apache 15 0 92552 5572 1376 S 1.9 0.3 0:00.25 httpd
26465 apache 15 0 92960 5924 1552 S 1.9 0.3 0:00.10 httpd
26469 apache 15 0 92552 5572 1376 S 1.9 0.3 0:00.17 httpd
28366 apache 15 0 92412 5496 1316 S 1.9 0.3 0:00.07 httpd
28373 apache 15 0 92552 5572 1376 S 1.9 0.3 0:00.06 httpd
28404 apache 15 0 92896 7840 3148 S 1.9 0.4 0:00.13 httpd
28659 apache 15 0 93952 8576 3164 S 1.9 0.4 0:00.08 httpd
28669 apache 15 0 92412 5476 1308 S 1.9 0.3 0:00.03 httpd
1 root 18 0 10344 728 612 S 0.0 0.0 0:01.92 init
5567 apache 15 0 93444 8360 2996 S 0.0 0.4 0:01.31 httpd
13547 apache 15 0 92960 5928 1552 S 0.0 0.3 0:00.86 httpd
13588 apache 15 0 92560 5760 1532 S 0.0 0.3 0:00.85 httpd
13725 apache 15 0 92544 5572 1376 S 0.0 0.3 0:00.92 httpd
-
11-12-2009, 06:52 AM #12Web Hosting Master
- Join Date
- Oct 2009
- Posts
- 1,063
Its sound like the dos attack. Try to check the no of connection to the port 80 using command,
#netstat -apn | grep:80
if its more than 200 or 250 its definitely the dos attack.
You need to get the firewall install and block the IPs responsible for attack.Shared Hosting | Reseller Hosting | VPS Hosting | Dedicated Servers
KeserHosting.Com
-
11-12-2009, 07:08 AM #13Temporarily Suspended
- Join Date
- Mar 2008
- Posts
- 372
keser, u might b rite, but ssh is down, going to restart services now to check the result
-
11-12-2009, 09:38 AM #14Temporarily Suspended
- Join Date
- Mar 2008
- Posts
- 372
-
11-13-2009, 08:03 AM #15Temporarily Suspended
- Join Date
- Mar 2008
- Posts
- 372
again ssh is down and I checked the load in DA, it shows : 1.69, 1.57, 0.93 - I don't think this load will bring a server down
RAM - 888MB used out of 1024mb and burst 1024mb is not even touched
-
11-13-2009, 08:28 AM #16Temporarily Suspended
- Join Date
- Mar 2008
- Posts
- 372
There are too many image not found msgs in apache error log, not sure how to handle them as it's my friend's old domain which he had stopped for a while and resumed as a new site but using old script, though all the old images are removed now, the load seems to be still very high from those old links which were submitted to various forums and blogs
-
11-13-2009, 08:39 AM #17Temporarily Suspended
- Join Date
- Mar 2008
- Posts
- 372
there are lots of httpd connections on the server,
-
11-13-2009, 04:35 PM #18Junior Guru
- Join Date
- Jul 2009
- Posts
- 240
you wouldnt happen to be running some sort of ssh blocker like denyhost?
check you logs first for any wierd ssh logs, allow.host, deny.host files
http traffic is not going to crash you sshd - just slow it down, which can be alleviated by traffic shaping to make sure ssh (and other time latency sensitive service like dns request and ntp are prioritized)
-
11-14-2009, 02:07 AM #19Disabled
- Join Date
- May 2009
- Location
- /home
- Posts
- 222
Hello,
You should optimize your apache. Also, I would like to recommend to install csf firewall by using this firewall you can prevent number of httpd connections to your server.
Similar Threads
-
high numfile usage & fails on VPS
By chamelion in forum Hosting Security and TechnologyReplies: 0Last Post: 06-02-2006, 02:57 PM -
If load very high, SSH login is not possible anymore
By CoolMike in forum Hosting Security and TechnologyReplies: 8Last Post: 04-25-2006, 11:08 AM -
Server load not very high but pages load slowly
By singtel22 in forum Hosting Security and TechnologyReplies: 17Last Post: 01-27-2005, 02:43 PM -
SSH fails 12a-1a last three days...
By Isaac.Eiland-Hall in forum Dedicated ServerReplies: 0Last Post: 12-31-2004, 03:17 AM -
Apache Fails to Load! Help please :(
By jackpot101 in forum Web HostingReplies: 15Last Post: 07-29-2003, 09:28 AM