• The APS Catalog has been deprecated and removed from all Plesk Obsidian versions.
    Applications already installed from the APS Catalog will continue working. However, Plesk will no longer provide support for APS applications.
  • Please be aware: with the Plesk Obsidian 18.0.78 release, the support for the ngx_pagespeed.so module will be deprecated and removed from the sw-nginx package.

Server failure in minutes due to high httpd-apache use (attack or bug)

mavera2

Basic Pleskian
In the last week suddenly I get errors for my server. I try to access my website I get 503 errors.

When I check "top" and other things I see these:

- 60-65 httpd (apache) processes. (Normally I have 30-35 httpd processes)
You can see graph here: http://s30.postimg.org/6oenl3vc1/httpd.jpg

- MySQL makes ~350 MB swap. (Normally it makes 40-50 MB swap)
Tuning primer says that:
* Current max_connections = 250
* Current threads_connected = 96
* Historic max_used_connections = 97

- Server all graphs: http://s29.postimg.org/3wm5fh5jr/general.jpg

- Inside "httpd.conf"
* ServerLimit 60
* MaxClients 60

- In "var\www\vhosts\example.com\logs\access_log" there is nothing that would seem like (D)DOS attack. I see normal server request.

- Nothing suspicious in "var\log\httpd\access_log"

- Inside my `var\www\vhosts\example.com\logs\error_log` I see too many errors like this:
* [Fri Jan 17 10:56:26 2014] [warn] [client 78.180.71.157] mod_fcgid: can't apply process slot for /var/www/cgi-bin/cgi_wrapper/cgi_wrapper

- Inside "\var\log\mysqld_log" no error

- Inside "\var\log\error_log" no error in that time

- Inside "\var\log\suexec_log" no error

How can I diagnose what causes my website to make DISK IO 100%, load average 10, very high swapping, and server doesn't respond requests. And how can I stop this to happen in future ?


When I restart mysql and httpd problem solves. But how can I diagnose the cause ?

Thank you in advance for your help.
 
Last edited:
@mavera2

Try,

# watch -n 5 "netstat -ano | grep -v unix | grep ESTABLISHED | grep \:80"


and see what connections server make when this happens
 
Back
Top