1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

Cpu usage - too many connection to port 53

Discussion in 'Plesk 9.x for Linux Issues, Fixes, How-To' started by majidA, Apr 7, 2010.

  1. majidA

    majidA Guest

    0
     
    I have high cpu usage load for httpd and named.
    i checked netstat by these commands and found too many connection with Time_Wait status:

    1)# netstat -anp :

    tcp 0 0 127.0.0.1:56268 127.0.0.1:53 TIME_WAIT -
    tcp 0 0 127.0.0.1:56269 127.0.0.1:53 TIME_WAIT -
    tcp 0 0 127.0.0.1:56266 127.0.0.1:53 TIME_WAIT -
    tcp 0 0 127.0.0.1:56267 127.0.0.1:53 TIME_WAIT -
    tcp 0 0 127.0.0.1:56265 127.0.0.1:53 TIME_WAIT -
    tcp 0 0 127.0.0.1:56261 127.0.0.1:53 TIME_WAIT -
    tcp 0 0 127.0.0.1:56280 127.0.0.1:53 TIME_WAIT -
    tcp 0 0 127.0.0.1:56278 127.0.0.1:53 TIME_WAIT -


    2) #netstat -tap
    tcp 0 0 MyLocalHostName:56335 MyLocalHostName:domain TIME_WAIT -
    tcp 0 0 MyLocalHostName:56334 MyLocalHostName:domain TIME_WAIT -
    tcp 0 0 MyLocalHostName:56321 MyLocalHostName:domain TIME_WAIT -
    tcp 0 0 MyLocalHostName:56320 MyLocalHostName:domain TIME_WAIT -
    tcp 0 0 MyLocalHostName:56323 MyLocalHostName:domain TIME_WAIT -
    tcp 0 0 MyLocalHostName:56322 MyLocalHostName:domain TIME_WAIT -
    tcp 0 0 MyLocalHostName:56325 MyLocalHostName:domain TIME_WAIT -
    tcp 0 0 MyLocalHostName:56324 MyLocalHostName:domain TIME_WAIT -
    tcp 0 0 MyLocalHostName:56327 MyLocalHostName:domain TIME_WAIT -
    tcp 0 0 MyLocalHostName:56326 MyLocalHostName:domain TIME_WAIT -


    I check my named configuration and it's not an open dns. please help me to resolve this problem.
     
  2. IgorG

    IgorG Forums Analyst Staff Member

    49
    24%
    Joined:
    Oct 27, 2009
    Messages:
    24,572
    Likes Received:
    1,243
    Location:
    Novosibirsk, Russia
    Did you tried check your server with chkrootkit, for example? Maybe it is compromised?
     
  3. padani

    padani Guest

    0
     
    Friend,

    Root kit or some other web or box exploit. Check the TEMP, dev/shm for suspicious hidden folders and files.
     
  4. majidA

    majidA Guest

    0
     
    I checked fstab

    I checked rootkit and all things are "ok"

    this is my /etc/fstab:

    LABEL=/ / ext3 defaults 1 1
    LABEL=/var /var ext3 defaults 1 2
    LABEL=/backup /backup ext3 defaults 1 2
    LABEL=/tmp /tmp ext3 noexec,nosuid,loop 1 2
    LABEL=/usr /usr ext3 defaults 1 2
    LABEL=/boot /boot ext3 defaults 1 2
    tmpfs /dev/shm tmpfs defaults 0 0
    devpts /dev/pts devpts gid=5,mode=620 0 0
    sysfs /sys sysfs defaults 0 0
    proc /proc proc defaults 0 0
    LABEL=SWAP-ddf1_HOST_ swap swap defaults 0 0



    But I have high cpu load?
     
    Last edited by a moderator: Apr 11, 2010
  5. majidA

    majidA Guest

    0
     
    any body help me to find periodic high load named httpd mysql load?
     
Loading...