high load average and very slow plesk loading...

[saatchi]

Hi,

One of my servers has a problem in the last 3 weeks. Indeed, this problem is beginning after install a fresh PSA 10 and I couldn't solve it, yet! I have another server with the same structure and they haven’t this problem.

Plesk 10.1.1, CentOS 5.5, Intel(R) Xeon(R) CPU - E5630 @ 2.53GHz

Plesk panel loading is very slow and as you see in the attachments, Apache CPU usage and panel CPU usage is very high!
Also when I get top report, you can see that load average is high. This is in change, constantly. Sometimes load average is more than 100 and just when I reboot the server, it will be good for less than 1 hour.
Even, sometimes command typing is very slow and when I execute a command, it has problem to do.

Could you please help me to find the problem? Let me know if you need any more information to solve it.

 

[IgorG]

Any errors from logs?

 

[saatchi]

httpd error_log

I get this lines (last 20):

[Tue Mar 22 08:54:19 2011] [warn] Init: SSL server IP/port conflict: default-00_000_000_14:443 (/usr/local/psa/admin/conf/generated/12990643590.51201400_server.include:183) vs. atmail.webmail:443 (/usr/local/psa/admin/conf/generated/12990643590.51201400_atmail.include:161)
[Tue Mar 22 08:54:19 2011] [warn] Init: SSL server IP/port conflict: default-00_000_000_13:443 (/usr/local/psa/admin/conf/generated/12990643590.51201400_server.include:145) vs. atmail.webmail:443 (/usr/local/psa/admin/conf/generated/12990643590.51201400_atmail.include:108)
[Tue Mar 22 08:54:19 2011] [warn] Init: SSL server IP/port conflict: default-00_000_000_12:443 (/usr/local/psa/admin/conf/generated/12990643590.51201400_server.include:107) vs. atmail.webmail:443 (/usr/local/psa/admin/conf/generated/12990643590.51201400_atmail.include:55)
[Tue Mar 22 08:54:19 2011] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!
[Tue Mar 22 08:54:19 2011] [notice] Apache configured -- resuming normal operations
sh: fetch: command not found
[Tue Mar 22 23:26:43 2011] [notice] child pid 13736 exit signal Segmentation fault (11)
[Wed Mar 23 00:08:24 2011] [notice] child pid 13719 exit signal Segmentation fault (11)
[Wed Mar 23 03:51:07 2011] [error] [client 199.16.130.48] Invalid URI in request GET HTTP/1.1
[Wed Mar 23 08:09:35 2011] [error] [client 67.212.167.58] Invalid URI in request GET HTTP/1.1 HTTP/1.1
[Wed Mar 23 08:09:36 2011] [error] [client 67.212.167.58] File does not exist: /var/www/vhosts/default/htdocs/haxplorer
[Wed Mar 23 08:09:36 2011] [error] [client 67.212.167.58] script '/var/www/vhosts/default/htdocs/phpshell.php' not found or unable to stat
[Wed Mar 23 08:09:37 2011] [error] [client 67.212.167.58] File does not exist: /var/www/vhosts/default/htdocs/haxplorer
[Wed Mar 23 08:09:37 2011] [error] [client 67.212.167.58] script '/var/www/vhosts/default/htdocs/mc.php' not found or unable to stat
[Wed Mar 23 08:09:38 2011] [error] [client 67.212.167.58] script '/var/www/vhosts/default/htdocs/pannelshell.php' not found or unable to stat
[Wed Mar 23 08:09:38 2011] [error] [client 67.212.167.58] File does not exist: /var/www/vhosts/default/htdocs/haxplorer
[Wed Mar 23 08:59:12 2011] [error] [client 85.185.162.184] Directory index forbidden by Options directive: /usr/share/psa-horde/themes/wps_sober/, referer: http://webmail.domain.com/imp/login.php
[Wed Mar 23 09:13:33 2011] [error] [client 82.128.200.122] File does not exist: /usr/share/psa-horde/robots.txt
[Wed Mar 23 09:22:54 2011] [error] [client 61.247.204.38] File does not exist: /var/www/vhosts/default/htdocs/robots.txt
[Wed Mar 23 09:35:52 2011] [error] [client 85.185.162.184] Directory index forbidden by Options directive: /usr/share/psa-horde/themes/wps_sober/, referer: http://webmail.domain.com/imp/login...x16LYrtqZW9t0U&app=horde&logout_reason=logout
[Wed Mar 23 10:28:42 2011] [error] [client 85.9.83.174] Directory index forbidden by Options directive: /usr/share/psa-horde/themes/wps_sober/, referer: http://webmail.domain.com/imp/login.php
[Wed Mar 23 10:33:01 2011] [error] [client 85.9.83.174] Directory index forbidden by Options directive: /usr/share/psa-horde/themes/wps_sober/, referer: http://webmail.domain.com/imp/login...p?uniq=1301733084218&nocache=225ws3bq1ped
[Wed Mar 23 10:46:17 2011] [error] [client 85.9.83.174] Directory index forbidden by Options directive: /usr/share/psa-horde/themes/wps_sober/, referer: http://webmail.domain.com/imp/mailbox.php?no_newmail_popup=1&mailbox=INBOX.Sent

 

[IgorG]

/var/www/vhosts/default/htdocs/phpshell.php

Are you sure that server is not compromised? Try to check it with chkrootkit or with rkhunter

 

[Pedrosantos]

Hi, i have the exact same problem , i ran the rhunter and nothing found, and this high loads as you described just started happening today....
My Plesk Version is 10.0 and im in CENTOS 5.5

 

[saatchi]

I checked it with chkrootkit. everything is ok and I just get one infected alert:

Checking `bindshell'... INFECTED (PORTS: 465)

well, I think it's usual for Plesk, isn't it? so this problem is not from that!

any other idea?

 

[saatchi]

Is there any way to monitor load average by processes?

 

[Pedrosantos]

Any one that can help ?

 

[IgorG]

Usually such problems require detailed and deep investigation directly on server. Real reasons can be found only after that. As you know there can be a lot of possible reasons. Therefore I suggest you contact support team if it is really important for you.

 

[Seyed AhmadS]

Are you sure that server is not compromised? Try to check it with chkrootkit or with rkhunter

hi,
how can we install psa modules like rkhunter?
is there any manual about that

 

[IgorG]

You should install psa-watchdog module which contains rkhunter.

 

[Seyed AhmadS]

You should install psa-watchdog module which contains rkhunter.

how to install psa-watchdog module.
is it in yum repository or in plesk administrator module manager?
is there any reference for this module for configuration?

thanks for your help IgorG

 

[IgorG]

Just run /usr/local/psa/admin/sbin/autoinstaller and select module for installation in menu.

 

[Seyed AhmadS]

how about the manual?

 

[IgorG]

how about the manual?

What do you mean?

 

[Seyed AhmadS]

where can i find the manual about using & configuring the watchdog and the firewall of plesk

 

[IgorG]

where can i find the manual about using & configuring the watchdog and the firewall of plesk

At the bottom of this page http://www.parallels.com/products/plesk/documentation/

 

[Seyed AhmadS]

this is plesk 10 documentation
i'm using plesk 9.5.1 for my VPS's

 

[IgorG]

Did you try to search documentation for 9.x on Parallels site?

http://www.parallels.com/products/plesk95/resources/

And why you write about 9.x problem in forum's section about 10.x?

 

[Seyed AhmadS]

thanks for your help