Apache uses all CPU, server dies

[Engineer]

Hello,

I apologize if something similar has been asked already. I went through the forum and i didn't see anything.

I have a dedicated server with the following specs

HDD 1500 GB SATA II-HDD 7.200 rpm
CPU AMD Athlon II X4 605e, Quad-Core
Template CentOS 6 - Plesk 10 - RAID 1 On the server I have 3 websites all of them in Wordpress. One of them receives very high traffic (up to 4 million views per month) , the other two receive insignificant traffic (less than 1000 views per month). Until a couple of months ago, the server could handle anything. There were days we would receive 60-70000 visits and 250k views with no problem at all. About 2 or 3 months ago something changed. Everytime we have increased traffic (note: the website is a sports website. So on Saturdays or Sundays when there's a match traffic increases) Apache uses all CPU, load average goes up to 100 (!!!), the server hangs and sometime "dies".


I do not remember changing anything in configuration and I could not determine whether it is a piece of bad code that might be causing it. I am trying to figure out what exactly is causing Apache to require all that CPU and since I am not a server configuration expert (I am a programmer/web developer) I am looking for some help. I have already enabled server status (anyone interested in seeing please let me know. ) but i do not know how to read it and understand it, so I am looking for answers there too.

I am also attaching my terminal when top is run, but not at peak hour. Maybe an expert's eye will see something off.


Andreas

 

[Faris Raouf]

You need to check the logs. One possibility is that your system is being attacked by a botnet or an individual who is constantly trying to guess passwords or access xmlrpc.php. Both of these can cause quite a high load.

Also, you should limit the number of apache processes that can run at any one time. Leaving it at an effectively unlimited number (which tends to be the default) can cause all sorts of problems -- running out of memory for example - if it comes under attack, or a combination of being attacked, real users accessing it, and some sort of search engine indexing box trying to read too many pages all at once.

Look in two places:
First, in /var/log/httpd/error_log for general apache errors.
Secondly, in /var/www/vhosts/domain-name/statistics/logs/access_log (and also error_log).
Look for wp-login.php being accessed a lot, or xmlrpc.php being accessed a lot.

If you are seeing loads of attempts to access wp-login, then think about installing a security suite, such as ASL, on your server, or using fail2ban or installing a security plugin in WordPress that will detect and block IPs that try to guess passwords.

A Wordpress security suite may also help you with bots or individuals that try to abuse xmlrpc.php but you can eliminate the problem with an .htaccess ReWrite rule.

To limit how many apache processes can run, have a look at /etc/httpd/conf/httpd.conf and think about reducing ServerLimit and MaxClients.

As you can see, each httpd process you have running takes between .1% and .4% memory. You definitely don't want the maximum number to be more than 100/.4 = 250 and that's an absolute maximum. But we're getting into an area where one solution does not fit all - there are other settings apart from MaxClients that can help, and it is far too complicated to deal with in a forum IMHO.