Results 1 to 19 of 19
  1. #1
    Join Date
    Mar 2008
    Posts
    372

    high load ssh fails

    my friend has an vps, its having heavy loads
    ram around 60%-90% used constantly currently and ssh fails
    it gives - server unexpectedly closed network connection
    can't login to ssh to check the load details and even error msg details

    can any one guide on how to proceed
    tried restarting server more than 5 times, but it goes to high load with in a minute time , so completely clueless on how to proceed

    cent os - 5.3, DA, vsxpathaway, apache (latest stable release)

  2. #2
    There can be n number of reasons for this. For a start, what you can do is login via SSH (if you can) and run the 'top' command to see which process(es) is eating up the resources and causing load.

    Code:
    root@server# top -d2c

  3. #3
    Join Date
    Mar 2008
    Posts
    372
    actually ssh isn't getting in, tht's the major problem,
    gives
    server unexpectedly closed network connection
    or
    doesn't give any msg and never even asks for logins, just prompt opens with nothing in it

  4. #4
    Ah okay. I thought that was an occasional problem and you might be able yo get in sometimes.
    Do you have WHM access to the server wherein you can restart the services (apache,exim,mysql) which would bring down the load and then you can get in via SSH.

  5. #5
    Join Date
    Nov 2004
    Location
    India
    Posts
    1,104
    It seems you are running short of resources, contact your host and ask them to increase the RAM.
    AssistanZ - Beyond Boundaries...
    Cloudstack Consultancy / 24x7 Web Hosting Support / 24x7 Server Management / Infrastructure Management Services
    Web & Mobile Apps Development / Web Designing Services / Php, Grails, Java Development

  6. #6
    If the problem has started suddenly out of nowhere then it is worth investigating the cause before increasing your resources. Of course, if you still cannot access the server then your host/datacenter would be in a better position to help.

  7. #7
    Join Date
    Jun 2006
    Location
    Houston, Texas
    Posts
    9
    I suggest logging into DA and shutting down ALL services except sshd then logging into the server to start determining the root of the problem. Start each service one at a time to see where your issues are. Also I recommend installing rkhunter and chkrootkit to find any rootkits that may be linked directly to your issue. Look for hidden files and directories with lsof. If needed I am for hire and would be willing to help correct this issue with you.

  8. #8
    Join Date
    Mar 2008
    Posts
    372
    there is still free RAM available

    have contacted the host, my friend is on un-managed plan so don't expect much out of them - to be frank

    yes there is vxspathway and DA, I think I can restart services from DA, I tried restarting server several times by now

  9. #9
    Quote Originally Posted by koolnhot View Post
    there is still free RAM available

    yes there is vxspathway and DA, I think I can restart services from DA
    Go ahead and do that. I did not notice earlier that you are using DA so I suggested doing that from WHM. Apologies for that.

  10. #10
    First of all restart apache and other services from directadmin and immediately get into server using ssh. After that check what service is consuming your more resources..If you notice you have many connections to 80 port. You should run 'iptraf' tool which is very handy to determine the connections consuming more resources.

  11. #11
    Join Date
    Mar 2008
    Posts
    372
    np carma, some how the site opened up with out restarting anything today, got load avgs from the hosting script itself, there is some prob still with "ssh", gives either access denied or server unexpectedly closed network connection

    current loads:
    top - 12:42:57 up 2:31, 0 users, load average: 0.10, 0.67, 1.00
    Tasks: 215 total, 2 running, 213 sleeping, 0 stopped, 0 zombie
    Cpu(s): 1.1%us, 0.9%sy, 0.0%ni, 98.0%id, 0.1%wa, 0.0%hi, 0.0%si, 0.0%st
    Mem: 2097152k total, 705680k used, 1391472k free, 0k buffers
    Swap: 0k total, 0k used, 0k free, 0k cached
    detailed report:
    PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
    18037 apache 15 0 92960 7868 3120 S 3.9 0.4 0:00.73 httpd
    29907 apache 15 0 12732 1232 836 R 3.9 0.1 0:00.03 top
    18365 apache 15 0 92684 7948 3268 S 1.9 0.4 0:00.66 httpd
    24070 apache 15 0 92960 5968 1552 S 1.9 0.3 0:00.23 httpd
    24084 apache 15 0 92552 5572 1376 S 1.9 0.3 0:00.30 httpd
    24150 apache 15 0 92552 5572 1376 S 1.9 0.3 0:00.25 httpd
    26465 apache 15 0 92960 5924 1552 S 1.9 0.3 0:00.10 httpd
    26469 apache 15 0 92552 5572 1376 S 1.9 0.3 0:00.17 httpd
    28366 apache 15 0 92412 5496 1316 S 1.9 0.3 0:00.07 httpd
    28373 apache 15 0 92552 5572 1376 S 1.9 0.3 0:00.06 httpd
    28404 apache 15 0 92896 7840 3148 S 1.9 0.4 0:00.13 httpd
    28659 apache 15 0 93952 8576 3164 S 1.9 0.4 0:00.08 httpd
    28669 apache 15 0 92412 5476 1308 S 1.9 0.3 0:00.03 httpd
    1 root 18 0 10344 728 612 S 0.0 0.0 0:01.92 init
    5567 apache 15 0 93444 8360 2996 S 0.0 0.4 0:01.31 httpd
    13547 apache 15 0 92960 5928 1552 S 0.0 0.3 0:00.86 httpd
    13588 apache 15 0 92560 5760 1532 S 0.0 0.3 0:00.85 httpd
    13725 apache 15 0 92544 5572 1376 S 0.0 0.3 0:00.92 httpd
    just posted till the record which showed max cpu load, there are still loads from 0.1 to 0.4

  12. #12
    Its sound like the dos attack. Try to check the no of connection to the port 80 using command,

    #netstat -apn | grep:80

    if its more than 200 or 250 its definitely the dos attack.
    You need to get the firewall install and block the IPs responsible for attack.
    Shared Hosting | Reseller Hosting | VPS Hosting | Dedicated Servers
    KeserHosting.Com

  13. #13
    Join Date
    Mar 2008
    Posts
    372
    keser, u might b rite, but ssh is down, going to restart services now to check the result

  14. #14
    Join Date
    Mar 2008
    Posts
    372
    Quote Originally Posted by keserhosting View Post
    Its sound like the dos attack. Try to check the no of connection to the port 80 using command,

    #netstat -apn | grep:80

    if its more than 200 or 250 its definitely the dos attack.
    You need to get the firewall install and block the IPs responsible for attack.
    finally ran the command, there was not even a single entry, when ran the command it just waits for the next command to be passed, no stats provided

  15. #15
    Join Date
    Mar 2008
    Posts
    372
    again ssh is down and I checked the load in DA, it shows : 1.69, 1.57, 0.93 - I don't think this load will bring a server down
    RAM - 888MB used out of 1024mb and burst 1024mb is not even touched

  16. #16
    Join Date
    Mar 2008
    Posts
    372
    There are too many image not found msgs in apache error log, not sure how to handle them as it's my friend's old domain which he had stopped for a while and resumed as a new site but using old script, though all the old images are removed now, the load seems to be still very high from those old links which were submitted to various forums and blogs

  17. #17
    Join Date
    Mar 2008
    Posts
    372
    there are lots of httpd connections on the server,

  18. #18
    Join Date
    Jul 2009
    Posts
    240
    you wouldnt happen to be running some sort of ssh blocker like denyhost?

    check you logs first for any wierd ssh logs, allow.host, deny.host files

    http traffic is not going to crash you sshd - just slow it down, which can be alleviated by traffic shaping to make sure ssh (and other time latency sensitive service like dns request and ntp are prioritized)

  19. #19
    Hello,

    You should optimize your apache. Also, I would like to recommend to install csf firewall by using this firewall you can prevent number of httpd connections to your server.

Similar Threads

  1. high numfile usage & fails on VPS
    By chamelion in forum Hosting Security and Technology
    Replies: 0
    Last Post: 06-02-2006, 02:57 PM
  2. If load very high, SSH login is not possible anymore
    By CoolMike in forum Hosting Security and Technology
    Replies: 8
    Last Post: 04-25-2006, 11:08 AM
  3. Server load not very high but pages load slowly
    By singtel22 in forum Hosting Security and Technology
    Replies: 17
    Last Post: 01-27-2005, 02:43 PM
  4. SSH fails 12a-1a last three days...
    By Isaac.Eiland-Hall in forum Dedicated Server
    Replies: 0
    Last Post: 12-31-2004, 03:17 AM
  5. Apache Fails to Load! Help please :(
    By jackpot101 in forum Web Hosting
    Replies: 15
    Last Post: 07-29-2003, 09:28 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •