• We value your experience with Plesk during 2024
    Plesk strives to perform even better in 2025. To help us improve further, please answer a few questions about your experience with Plesk Obsidian 2024.
    Please take this short survey:

    https://pt-research.typeform.com/to/AmZvSXkx
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

Server failure in minutes due to high httpd-apache use (attack or bug)

mavera2

Basic Pleskian
In the last week suddenly I get errors for my server. I try to access my website I get 503 errors.

When I check "top" and other things I see these:

- 60-65 httpd (apache) processes. (Normally I have 30-35 httpd processes)
You can see graph here: http://s30.postimg.org/6oenl3vc1/httpd.jpg

- MySQL makes ~350 MB swap. (Normally it makes 40-50 MB swap)
Tuning primer says that:
* Current max_connections = 250
* Current threads_connected = 96
* Historic max_used_connections = 97

- Server all graphs: http://s29.postimg.org/3wm5fh5jr/general.jpg

- Inside "httpd.conf"
* ServerLimit 60
* MaxClients 60

- In "var\www\vhosts\example.com\logs\access_log" there is nothing that would seem like (D)DOS attack. I see normal server request.

- Nothing suspicious in "var\log\httpd\access_log"

- Inside my `var\www\vhosts\example.com\logs\error_log` I see too many errors like this:
* [Fri Jan 17 10:56:26 2014] [warn] [client 78.180.71.157] mod_fcgid: can't apply process slot for /var/www/cgi-bin/cgi_wrapper/cgi_wrapper

- Inside "\var\log\mysqld_log" no error

- Inside "\var\log\error_log" no error in that time

- Inside "\var\log\suexec_log" no error

How can I diagnose what causes my website to make DISK IO 100%, load average 10, very high swapping, and server doesn't respond requests. And how can I stop this to happen in future ?


When I restart mysql and httpd problem solves. But how can I diagnose the cause ?

Thank you in advance for your help.
 
Last edited:
@mavera2

Try,

# watch -n 5 "netstat -ano | grep -v unix | grep ESTABLISHED | grep \:80"


and see what connections server make when this happens
 
Back
Top