under attack?

[Mr.Yes]

Hi in the last 3 days i have some problem with my box, for 5/10 min a couple a times a day i have cpu overloaded and i don't know why, then it returns to normal, can some of you suggest me some solution?

Here is my Top:

[root@ns1 root]# top
10:47:01 up 289 days, 18:00, 1 user, load average: 19.19, 12.10, 5.54
266 processes: 244 sleeping, 22 running, 0 zombie, 0 stopped
CPU states: cpu user nice system irq softirq iowait idle
total 93.2% 0.0% 6.3% 0.1% 0.1% 0.0% 0.0%
Mem: 1027376k av, 1009900k used, 17476k free, 0k shrd, 113116k buff
763336k actv, 145132k in_d, 15916k in_c
Swap: 2096440k av, 101052k used, 1995388k free 469860k cached

PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
6108 apache 25 0 15404 10M 2380 R 9.9 1.0 0:22 0 httpd
6120 apache 25 0 14084 9812 2368 R 9.9 0.9 0:21 0 httpd
24274 apache 25 0 17740 12M 2648 R 9.5 1.2 0:58 0 httpd
21560 apache 25 0 18320 7596 2652 R 7.9 0.7 0:34 0 httpd
21561 apache 25 0 17996 12M 2624 R 7.9 1.2 0:29 0 httpd
24226 apache 25 0 17284 8956 2584 R 7.9 0.8 0:31 0 httpd
31843 apache 25 0 17628 13M 2656 R 7.9 1.3 0:26 0 httpd
6118 apache 25 0 11664 7220 2048 R 7.9 0.7 0:21 0 httpd
24173 apache 25 0 16588 11M 2564 R 7.7 1.1 0:26 0 httpd
6119 apache 25 0 13960 9656 2344 R 7.7 0.9 0:26 0 httpd
3886 root 15 0 4656 1484 836 S 4.5 0.1 13518m 0 dcstor32d
21201 apache 15 0 19808 15M 3436 S 2.3 1.5 0:10 0 httpd
6770 apache 15 0 16088 11M 3624 S 2.3 1.1 0:00 0 httpd
24192 apache 15 0 17276 12M 3544 S 0.5 1.2 0:06 0 httpd
6698 apache 16 0 15080 10M 3444 S 0.5 1.0 0:00 0 httpd
10:48:16 up 289 days, 18:01, 1 user, load average: 17.09, 13.13, 6.41
266 processes: 248 sleeping, 17 running, 1 zombie, 0 stopped
CPU states: cpu user nice system irq softirq iowait idle
total 91.6% 0.0% 8.1% 0.1% 0.0% 0.0% 0.0%
Mem: 1027376k av, 1012212k used, 15164k free, 0k shrd, 113548k buff
766576k actv, 145672k in_d, 15888k in_c
Swap: 2096440k av, 102652k used, 1993788k free 470688k cached

PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
24226 apache 25 0 17252 7456 2552 R 9.9 0.7 0:37 0 httpd
6108 apache 25 0 15404 10M 2380 R 9.9 1.0 0:28 0 httpd
6118 apache 25 0 11664 7220 2048 R 9.9 0.7 0:27 0 httpd
6120 apache 25 0 14084 9812 2368 R 9.9 0.9 0:28 0 httpd
24274 apache 25 0 17708 12M 2616 R 9.3 1.2 1:04 0 httpd
24173 apache 25 0 16552 11M 2528 R 8.7 1.1 0:33 0 httpd
21560 apache 25 0 18284 7560 2616 R 7.9 0.7 0:41 0 httpd
31843 apache 25 0 17596 13M 2624 R 7.9 1.3 0:32 0 httpd
21561 apache 25 0 17964 12M 2592 R 7.7 1.2 0:35 0 httpd
3886 root 15 0 4644 1472 824 S 4.5 0.1 13518m 0 dcstor32d
6770 apache 15 0 19608 15M 4824 S 1.5 1.5 0:01 0 httpd
7076 apache 15 0 17840 13M 4472 S 1.5 1.3 0:00 0 httpd
6764 apache 15 0 18428 13M 4340 S 0.9 1.3 0:01 0 httpd
6769 apache 16 0 17172 12M 3860 S 0.7 1.2 0:01 0 httpd
21628 apache 15 0 20248 14M 3976 S 0.3 1.4 0:11 0 httpd
6852 apache 15 0 18916 14M 4716 S 0.3 1.4 0:01 0 httpd
7484 root 15 0 1296 1296 896 R 0.3 0.1 0:00 0 top
5 root 15 0 0 0 0 SW 0.1 0.0 111:08 0 kscand
24224 apache 15 0 21252 16M 3916 S 0.1 1.6 0:08 0 httpd
24227 apache 15 0 19752 15M 4016 S 0.1 1.5 0:37 0 httpd
7734 qmaild 15 0 0 0 0 Z 0.1 0.0 0:00 0 qmail-smtpd <defunct>
7749 root 15 0 872 872 684 S 0.1 0.0 0:00 0 pop3login
1 root 15 0 500 472 440 S 0.0 0.0 0:35 0 init
2 root 15 0 0 0 0 SW 0.0 0.0 2:05 0 keventd
3 root 34 19 0 0 0 SWN 0.0 0.0 0:00 0 ksoftirqd/0
6 root 15 0 0 0 0 SW 0.0 0.0 0:00 0 bdflush
4 root 15 0 0 0 0 SW 0.0 0.0 27:42 0 kswapd
7 root 15 0 0 0 0 SW 0.0 0.0 0:52 0 kupdated
8 root 25 0 0 0 0 SW 0.0 0.0 0:00 0 mdrecoveryd
16 root 25 0 0 0 0 SW 0.0 0.0 0:00 0 scsi_eh_0
19 root 15 0 0 0 0 SW 0.0 0.0 31:26 0 kjournald
73 root 22 0 0 0 0 SW 0.0 0.0 0:00 0 khubd
1869 root 15 0 0 0 0 SW 0.0 0.0 0:00 0 usb-storage-0
1870 root 15 0 0 0 0 SW 0.0 0.0 0:00 0 scsi_eh_1
2780 root 15 0 0 0 0 SW 0.0 0.0 0:00 0 kjournald
2781 root 15 0 0 0 0 SW 0.0 0.0 25:59 0 kjournald
2782 root 15 0 0 0 0 SW 0.0 0.0 6:39 0 kjournald
3491 root 15 0 2584 1436 1276 S 0.0 0.1 73:04 0 procfgd
3512 root 15 0 560 540 480 R 0.0 0.0 36:04 0 syslogd
3516 root 15 0 440 428 380 S 0.0 0.0 0:00 0 klogd


Thanx

 

[CrK01]

hello

same here !

 

[ricebus]

Hey,

This is happening to me too.
Apache has gone crazy, I see about 30-40 apache proccesses running which causes a cpu overload.

4:32AM up 36 days, 15:47, 1 users, load averages: 56.50, 58.88, 64.78


This is seriously crazy.

Anyone has an idea?
Maybe it has something to do whith the httpd.conf:

# prefork MPM
# StartServers: number of server processes to start
# MinSpareServers: minimum number of server processes which are kept spare
# MaxSpareServers: maximum number of server processes which are kept spare
# MaxClients: maximum number of server processes allowed to start
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule prefork.c>
StartServers 5
MinSpareServers 5
MaxSpareServers 10
MaxClients 150
MaxRequestsPerChild 0
</IfModule>

# worker MPM
# StartServers: initial number of server processes to start
# MaxClients: maximum number of simultaneous client connections
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadsPerChild: constant number of worker threads in each server process
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule worker.c>
StartServers 2
MaxClients 150
MinSpareThreads 25
MaxSpareThreads 75
ThreadsPerChild 25
MaxRequestsPerChild 0
</IfModule>

# perchild MPM
# NumServers: constant number of server processes
# StartThreads: initial number of worker threads in each server process
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# MaxThreadsPerChild: maximum number of worker threads in each server process
# MaxRequestsPerChild: maximum number of connections per server process
<IfModule perchild.c>
NumServers 5
StartThreads 5
MinSpareThreads 5
MaxSpareThreads 10
MaxThreadsPerChild 20
MaxRequestsPerChild 0
</IfModule>

# WinNT MPM
# ThreadsPerChild: constant number of worker threads in the server process
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule mpm_winnt.c>
ThreadsPerChild 250
MaxRequestsPerChild 0
</IfModule>

# BeOS MPM
# StartThreads: how many threads do we initially spawn?
# MaxClients: max number of threads we can have (1 thread == 1 client)
# MaxRequestsPerThread: maximum number of requests each thread will process
<IfModule beos.c>
StartThreads 10
MaxClients 50
MaxRequestsPerThread 10000
</IfModule>

# NetWare MPM
# ThreadStackSize: Stack size allocated for each worker thread
# StartThreads: Number of worker threads launched at server startup
# MinSpareThreads: Minimum number of idle threads, to handle request spikes
# MaxSpareThreads: Maximum number of idle threads
# MaxThreads: Maximum number of worker threads alive at the same time
# MaxRequestsPerChild: Maximum number of requests a thread serves. It is
# recommended that the default value of 0 be set for this
# directive on NetWare. This will allow the thread to
# continue to service requests indefinitely.
<IfModule mpm_netware.c>
ThreadStackSize 65536
StartThreads 250
MinSpareThreads 25
MaxSpareThreads 250
MaxThreads 1000
MaxRequestsPerChild 0
MaxMemFree 100
</IfModule>


# OS/2 MPM
# StartServers: Number of server processes to maintain
# MinSpareThreads: Minimum number of idle threads per process,
# to handle request spikes
# MaxSpareThreads: Maximum number of idle threads per process
# MaxRequestsPerChild: Maximum number of connections per server process
<IfModule mpmt_os2.c>
StartServers 2
MinSpareThreads 5
MaxSpareThreads 10
MaxRequestsPerChild 0
</IfModule>

 

[CrK01]

i have solved it

I install PHP 5.2.2 lastly, and 2 of our webs where incompatible with one function.

The result was an infinite bucle in these 2 webs, so apache takes 99% of this process.

I knew the 2 webs, making top, and ls -la /proc/PID ( pid of the instance that takes 99% )

After that, I disabled PHP LOGS of these 2 webs, and now all right