• If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
    CentOS2Alma discussion

Server failure in minutes due to high httpd-apache use (attack or bug)

mavera2

Basic Pleskian
In the last week suddenly I get errors for my server. I try to access my website I get 503 errors.

When I check "top" and other things I see these:

- 60-65 httpd (apache) processes. (Normally I have 30-35 httpd processes)
You can see graph here: http://s30.postimg.org/6oenl3vc1/httpd.jpg

- MySQL makes ~350 MB swap. (Normally it makes 40-50 MB swap)
Tuning primer says that:
* Current max_connections = 250
* Current threads_connected = 96
* Historic max_used_connections = 97

- Server all graphs: http://s29.postimg.org/3wm5fh5jr/general.jpg

- Inside "httpd.conf"
* ServerLimit 60
* MaxClients 60

- In "var\www\vhosts\example.com\logs\access_log" there is nothing that would seem like (D)DOS attack. I see normal server request.

- Nothing suspicious in "var\log\httpd\access_log"

- Inside my `var\www\vhosts\example.com\logs\error_log` I see too many errors like this:
* [Fri Jan 17 10:56:26 2014] [warn] [client 78.180.71.157] mod_fcgid: can't apply process slot for /var/www/cgi-bin/cgi_wrapper/cgi_wrapper

- Inside "\var\log\mysqld_log" no error

- Inside "\var\log\error_log" no error in that time

- Inside "\var\log\suexec_log" no error

How can I diagnose what causes my website to make DISK IO 100%, load average 10, very high swapping, and server doesn't respond requests. And how can I stop this to happen in future ?


When I restart mysql and httpd problem solves. But how can I diagnose the cause ?

Thank you in advance for your help.
 
Last edited:
@mavera2

Try,

# watch -n 5 "netstat -ano | grep -v unix | grep ESTABLISHED | grep \:80"


and see what connections server make when this happens
 
Back
Top