• If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
    CentOS2Alma discussion
  • Inviting everyone to the UX test of a new security feature in the WP Toolkit
    For WordPress site owners, threats posed by hackers are ever-present. Because of this, we are developing a new security feature for the WP Toolkit. If the topic of WordPress website security is relevant to you, we would be grateful if you could share your experience and help us test the usability of this feature. We invite you to join us for a 1-hour online session via Google Meet. Select a convenient meeting time with our friendly UX staff here.

Server failure in minutes due to high httpd-apache use (attack or bug)

mavera2

Basic Pleskian
In the last week suddenly I get errors for my server. I try to access my website I get 503 errors.

When I check "top" and other things I see these:

- 60-65 httpd (apache) processes. (Normally I have 30-35 httpd processes)
You can see graph here: http://s30.postimg.org/6oenl3vc1/httpd.jpg

- MySQL makes ~350 MB swap. (Normally it makes 40-50 MB swap)
Tuning primer says that:
* Current max_connections = 250
* Current threads_connected = 96
* Historic max_used_connections = 97

- Server all graphs: http://s29.postimg.org/3wm5fh5jr/general.jpg

- Inside "httpd.conf"
* ServerLimit 60
* MaxClients 60

- In "var\www\vhosts\example.com\logs\access_log" there is nothing that would seem like (D)DOS attack. I see normal server request.

- Nothing suspicious in "var\log\httpd\access_log"

- Inside my `var\www\vhosts\example.com\logs\error_log` I see too many errors like this:
* [Fri Jan 17 10:56:26 2014] [warn] [client 78.180.71.157] mod_fcgid: can't apply process slot for /var/www/cgi-bin/cgi_wrapper/cgi_wrapper

- Inside "\var\log\mysqld_log" no error

- Inside "\var\log\error_log" no error in that time

- Inside "\var\log\suexec_log" no error

How can I diagnose what causes my website to make DISK IO 100%, load average 10, very high swapping, and server doesn't respond requests. And how can I stop this to happen in future ?


When I restart mysql and httpd problem solves. But how can I diagnose the cause ?

Thank you in advance for your help.
 
Last edited:
@mavera2

Try,

# watch -n 5 "netstat -ano | grep -v unix | grep ESTABLISHED | grep \:80"


and see what connections server make when this happens
 
Back
Top