backend is overloaded, we disable it for a 2 seconds

[TairkH]

---------------------------------------------------------------
Plesk panel, 0.3.1, Centos 5.7 , x86_64

My plesk panel is very very slow loading!
It will be loading for 2min to acces it.
I find this in de plesk error_log

/var/log/sw-cp-server/error_log:

2011-10-28 01:37:07: (mod_fastcgi.c.2873) backend is overloaded, we disable it for a 2 seconds and send the request to another backend instead: reconnects: 0 load: 139
2011-10-28 01:37:07: (mod_fastcgi.c.2873) backend is overloaded, we disable it for a 2 seconds and send the request to another backend instead: reconnects: 1 load: 139
2011-10-28 01:37:07: (mod_fastcgi.c.2873) backend is overloaded, we disable it for a 2 seconds and send the request to another backend instead: reconnects: 2 load: 139
2011-10-28 01:37:07: (mod_fastcgi.c.2873) backend is overloaded, we disable it for a 2 seconds and send the request to another backend instead: reconnects: 3 load: 139
2011-10-28 01:37:07: (mod_fastcgi.c.2873) backend is overloaded, we disable it for a 2 seconds and send the request to another backend instead: reconnects: 4 load: 139
2011-10-28 01:37:07: (mod_fastcgi.c.2873) backend is overloaded, we disable it for a 2 seconds and send the request to another backend instead: reconnects: 5 load: 139
2011-10-28 01:37:07: (mod_fastcgi.c.2873) backend is overloaded, we disable it for a 2 seconds and send the request to another backend instead: reconnects: 0 load: 139
2011-10-28 01:37:07: (mod_fastcgi.c.2873) backend is overloaded, we disable it for a 2 seconds and send the request to another backend instead: reconnects: 1 load: 139
2011-10-28 01:37:07: (mod_fastcgi.c.2873) backend is overloaded, we disable it for a 2 seconds and send the request to another backend instead: reconnects: 2 load: 139
2011-10-28 01:37:08: (connections.c.299) SSL: 1 error:140780E5:SSL routines:SSL23_READ:ssl handshake failure
2011-10-28 01:37:10: (mod_fastcgi.c.2651) fcgi-server re-enabled: 0 /usr/local/psa/tmp/sw-engine.sock
2011-10-28 01:37:10: (mod_fastcgi.c.2651) fcgi-server re-enabled: 0 /usr/local/psa/tmp/sw-engine.sock
2011-10-28 01:37:10: (mod_fastcgi.c.2651) fcgi-server re-enabled: 0 /usr/local/psa/tmp/sw-engine.sock
2011-10-28 01:37:10: (mod_fastcgi.c.2651) fcgi-server re-enabled: 0 /usr/local/psa/tmp/sw-engine.sock
2011-10-28 01:37:10: (mod_fastcgi.c.2651) fcgi-server re-enabled: 0 /usr/local/psa/tmp/sw-engine.sock
2011-10-28 01:37:10: (mod_fastcgi.c.2651) fcgi-server re-enabled: 0 /usr/local/psa/tmp/sw-engine.sock
2011-10-28 01:37:10: (mod_fastcgi.c.2651) fcgi-server re-enabled: 0 /usr/local/psa/tmp/sw-engine.sock
2011-10-28 01:37:10: (mod_fastcgi.c.2651) fcgi-server re-enabled: 0 /usr/local/psa/tmp/sw-engine.sock
2011-10-28 01:37:10: (mod_fastcgi.c.2651) fcgi-server re-enabled: 0 /usr/local/psa/tmp/sw-engine.sock
all children busy, launch additional (total 3, limit 30)


My processlist say's this:

psaadm 3898 0.0 0.0 224688 14564 ? Ss 01:23 0:00 \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaad
psaadm 8416 0.0 0.1 287232 31984 ? S 01:27 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 8429 0.0 0.1 288556 33032 ? S 01:27 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 8430 0.0 0.1 287488 32176 ? S 01:27 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 7561 0.0 0.0 224696 14556 ? Ss 01:25 0:00 \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaad
psaadm 8967 0.0 0.1 287236 31956 ? S 01:28 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 8968 0.0 0.1 287236 31956 ? S 01:28 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 8969 0.0 0.1 287236 31936 ? S 01:28 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 8375 0.0 0.0 224720 14564 ? Ss 01:27 0:00 \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaad
psaadm 9655 0.0 0.1 287260 32052 ? S 01:30 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 9666 0.0 0.1 287260 32036 ? S 01:30 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 9678 0.0 0.2 288296 33088 ? S 01:30 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 8970 0.0 0.0 224724 14556 ? Ss 01:28 0:00 \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaad
psaadm 10303 0.0 0.1 287268 31912 ? S 01:31 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 10304 0.0 0.1 287268 31892 ? S 01:31 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 10305 0.0 0.1 287268 31912 ? S 01:31 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 9680 0.0 0.0 224668 14564 ? Ss 01:30 0:00 \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaad
psaadm 10865 0.0 0.1 287212 31904 ? S 01:32 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 10874 0.0 0.1 287212 31884 ? S 01:32 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 10875 0.0 0.1 287212 31884 ? S 01:32 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 10274 0.0 0.0 224700 14564 ? Ss 01:31 0:00 \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaad
psaadm 11524 0.0 0.1 287244 31916 ? S 01:34 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 11525 0.0 0.1 287244 31892 ? S 01:34 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 11526 0.0 0.1 287244 31892 ? S 01:34 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 10885 0.0 0.0 224704 14560 ? Ss 01:32 0:00 \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaad
psaadm 12166 0.0 0.1 287248 31912 ? S 01:35 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 12167 0.0 0.1 287248 31932 ? S 01:35 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 12168 0.0 0.1 287248 31912 ? S 01:35 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 11499 0.0 0.0 224692 14564 ? Ss 01:34 0:00 \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaad
psaadm 12742 0.0 0.1 287236 31880 ? S 01:37 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 12743 0.0 0.1 287236 31880 ? S 01:37 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 12744 0.0 0.1 288268 32932 ? S 01:37 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 12125 0.0 0.0 224660 14564 ? Ss 01:35 0:00 \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaad
psaadm 13342 0.3 0.1 287204 31920 ? S 01:38 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 13365 0.3 0.1 288240 32956 ? S 01:38 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 13366 0.3 0.1 287204 31920 ? S 01:38 0:00 | \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u p
psaadm 12774 0.0 0.0 224692 14556 ? Ss 01:37 0:00 \_ /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaad

Server load is fine:

top - 01:41:59 up 18 min, 1 user, load average: 0.41, 0.48, 0.49
Tasks: 402 total, 3 running, 399 sleeping, 0 stopped, 0 zombie
Cpu(s): 1.9%us, 0.4%sy, 0.0%ni, 97.6%id, 0.1%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 16521784k total, 4581176k used, 11940608k free, 106944k buffers
Swap: 4192956k total, 0k used, 4192956k free, 1604852k cached

--------------------------------------------------------------


A reboot didn't fixed it!
Nothing has been changed server was running fine for at least 2 months.

Any help?

Greetz

 

[IgorG]

Do you have any suspicious in /var/log/secure ? It looks like brute-force attack on the sw-cp-server.

 

[TairkH]

Your right!
It was brute force attack on plesk.
I blocked the ip and it's working fine again.

Thanx anyway

 

[200002]

IgorG or TairkH...

How do I block the ip:s I seems to have the same problem with an attack?

http://forum.parallels.com/showthread.php?t=263205

 

[IgorG]

Just firewall IP of attackers

 

[200002]

Thanks for oyur reply IgorG. Do I do it In plesk panel or though putty or thought ssh directly in the files. Do I need to restart http-server or psa afterwords?

Do you mind taking a look here and see if I am on the right track:
http://forum.parallels.com/showthread.php?p=641009&posted=1#post641009

I was thinking about doing these steps http://kb.parallels.com/en/8119

One of the steps was to block the host using tcp wrappers. Not sure if it helps but.

Add the following rule into the /etc/hosts.allow file:

sshd: <admin IP address>/<netmask> : allow
sshd: ALL : deny

But i don't know how I shall write:

sshd: xxx.xx.xx.xx/? : allow

How do I find the netmask is it 255.255.0.0 instead of?

 

[IgorG]

Just block IP address with iptables. Something like:

# iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP

 

[200002]

Ok so pretend I want to block ip 123.12.12.12

I then log in as root in Putty on the server and write command:

# iptables -A INPUT -s 123.12.12.12 -j DROP

Is that correct?

Again BIG thanks for helping a newbie!!!

 

[200002]

How do I write if I want to block several at once?

 

[IgorG]

Yes, you can do it in ssh session or use Plesk Firewall Extension and use Plesk GUI for IP address blocking.

 

[IgorG]

How do I write if I want to block several at once?

Look at iptables documentation. It is common Linux administrative task. If you are not familiar with it - contact Support Team.