24 hours ago something wired happend..
For some reason httpd is causing high serverload.
ATM : 22:44:17 up 22:17, 2 users, load average: 6.23, 6.12, 8.88
U
Will keep gooing up and httpd need to be restartet when serverload comes up to 30.
The traffic on the server is normal, no changes is made on the server.
from top:
12478 root 35 19 2004 680 308 R 39 0.0 8:54.95 gzip
using anywhere from 30-50% of my cpu for nearly 10 min now. but, no memory usage.
any ideas? should i kill the pid?
site is running pretty slow as a result of this.
Opt 248
3gb ram
250gb sata II
I have a fairly unique problem. My server runs great 95% of the time. Loads average under 1. However backups have become a server killer. I use cpanel scheduled backup at early morning hours. The reason backups kill my server is that I have 300,000+ (and counting) images in a directory. They are all small pngs generated by LaTeX. It takes my server several hours to backup the images. I usually even have to stop apache to free up some power. This problem is only going to get worse as I get more images. Maybe I could upgrade proc or upgrade to faster HD? That would be costly, hopefully not.
Should I hire a professional backup service? Costly, and would that help? Or is there a way of storing the images or doing the cpbackup I am doing wrong?
if it was possible to kill a server running WHMCS by executing the cron.php via cronjob on a remote server once every minute.
I just wanted to see if this was potentially harmful, so I can submit it to Matt without sounding like an idiot...
We're running on Linux/Apache/MySQL/RoR and have a number of cron jobs that run throughout the day on our server. We've been noticing lately that at certain times of the day the site becomes really slow. When I'm online with my engineers I can mention this to them and they can check and see and say "Oh yeah, it's job XYZ that's spiking the server load."
That's great but much of the time when I notice the sluggishness my developers are offline (we're in different time zones). I'm wondering if there's a fairly easy way to track this when they're not online so we can say "Yup, last night at 10 PM your time when you noticed that it was job ABC." There has to be something that allows you to do this right?
i am using seperate server for sql .But my httpd server failed many time when i checked maximum number of httpd connection then my sql server using too many connection what is the reason of this problem . Is my sql server using as a slave in a ddos attack or sql server need http connection?
View 2 Replies View RelatedI have a VPS with 768Mb of RAM which was always suitable for the websites I'm hosting
as most of them are not popular and none of them got high traffic recently at all
But for over 2 days the vps is eating the ram and killing all the services (cpanel/httpd/ftp/MySQL..)
I want to know what is causing this and stop it by any way
I contacted my vps support and they told me to write "top" in the SSH but I didn't understand any thing from what I see and I didn't know what to do after writing that command .
I remember long time ago when I used to host on Layered Tech fast network good stuff, affordable price my first server costed me 90 dollars on Layered Tech with about 20 dollar setup one time fee.
I visited today after about 2 years and I'm pretty much surprised to see their prices they are by no means affordable as they were previously and the setup fee is now 50 dollars on every server.
With such large number of servers in their data centers shouldn't they be able to make them affordable? yet I have seen same server on WHT ads section for fraction of the price LT expects and not to mention the excessive setup fee.
I'm not complaining, its their business, but is it really helping them? I cant be the only person feeling this anti-love for Layered Tech being a former LT customer, I had no problems with them or their services I just left after I sold my site and moved into VPS. But seeing the new prices its a bit shocking.
the server load averges on my VPS have been very high - escalating to 6.5 in cases.
The process causing this is:
PidOwnerPriorityCpu %Mem %Command 7370 mysql -10
76.7
3.0 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/opal.ngwebservers.net.pid --skip-external-locking
My VPS is hosted by Virpus Networks, and has spec:
512RAM (1024 burstable), 10GB hard drive space.
8 of these processors on node:
Processor #1 Vendor: GenuineIntel
Processor #1 Name: Intel(R) Xeon(TM) CPU 2.80GHz
Processor #1 speed: 174.594 MHz
Processor #1 cache size: 2048 KB
No hardware or software changes were implemented on the VPS as far as I am aware.
The MySQL process causing this is:
28993movies_mybblocalhostmovies_mybbQuery36Copying to tmp tableSELECT t.tid, t.dateline, p.edittime, t.subject, f.allowhtml, f.allowmycode, f.allowsmilies, f.allow
This has been going on since I first saw the loads go high...
I have many servers on vrtservers.net and is happy of they support. And I planing be a reseller of them.
But the nightmare come from last day..
My main server have got some SPAM report from spamcap.net
[url]
the spamcap.net report my server runing a open proxy.and somebody using it as SPAM.
before the SPAM report..
I know this ISSUE and have fix it..
so the proxy just run many hours.[ check the mrtg graph.[url]
sinse the SPAM report.
vrtserver.net put this server offline..
I can Understand it.
And I have contact the support@vrtservers.net Instantly.
And I proceed the case of spamcap.net too.
But the nightmare is ....
When I ask "how to reconnect my servers/What time will the case close?" to VRTSERVERs.NET.
the vrtservers.net reply to me said the server has been terminated and there is no way to get my data back.
My god ..
all of my server's data has been lost!
vrtservers.net is killing me now!
I have a VPS with 320MB of RAM. The problem is that spammassassin is killing my VPS.
Spamd service was using 50% of memory (+- 150MB of RAM).
Do you think that this is normal RAM for Spamd?
trying to get mod_security installed on my HSphere server, the install goes ok until i try and load rules?
If i just load the exclude.conf rule then php sites work, if i also load rules.conf or any other rules then my php sites get 'connection refused error' ?
I cannot find any thing in logs and there is no log written for mod_security?
here is my modsecurity.conf
Quote:
#If you want to scan the output, uncomment these
#SecFilterScanOutput On
#SecFilterOutputMimeTypes "(null) text/html text/plain"
# Accept almost all byte values
SecFilterForceByteRange 1 255
# Server masking is optional
#fake server banner - NOYB used - no one needs to know what we are using
SecServerSignature "NOYB"
#SecUploadDir /tmp
#SecUploadKeepFiles Off
# Only record the interesting stuff
SecAuditEngine RelevantOnly
SecAuditLog /var/log/audit_log
# You normally won't need debug logging
SecFilterDebugLevel 0
SecFilterDebugLog logs/modsec_debug_log
#And now, the rules
#Remove any of these Include lines you do not use or have rules for.
#First, add in your exclusion rules:
#These MUST come first!
Include /etc/modsecurity/exclude.conf
#Application protection rules
#Include /etc/modsecurity/rules.conf
bash-2.05b# cat /etc/modsecurity.conf
<IfModule mod_security.c>
# Only inspect dynamic requests
# (YOU MUST TEST TO MAKE SURE IT WORKS AS EXPECTED)
#SecFilterEngine DynamicOnly
SecFilterEngine On
# Reject requests with status 500
SecFilterDefaultAction "deny,log,status:500"
# Some sane defaults
SecFilterScanPOST On
SecFilterCheckURLEncoding On
SecFilterCheckCookieFormat On
SecFilterCheckUnicodeEncoding Off
SecFilterNormalizeCookies On
# enable version 1 (RFC 2965) cookies
SecFilterCookieFormat 1
SecServerResponseToken Off
#If you want to scan the output, uncomment these
#SecFilterScanOutput On
#SecFilterOutputMimeTypes "(null) text/html text/plain"
# Accept almost all byte values
SecFilterForceByteRange 1 255
# Server masking is optional
#fake server banner - NOYB used - no one needs to know what we are using
SecServerSignature "NOYB"
#SecUploadDir /tmp
#SecUploadKeepFiles Off
# Only record the interesting stuff
SecAuditEngine RelevantOnly
SecAuditLog /var/log/audit_log
# You normally won't need debug logging
SecFilterDebugLevel 0
SecFilterDebugLog logs/modsec_debug_log
#And now, the rules
#Remove any of these Include lines you do not use or have rules for.
#First, add in your exclusion rules:
#These MUST come first!
Include /etc/modsecurity/exclude.conf
#Application protection rules
#Include /etc/modsecurity/rules.conf
#Comment spam rules
#Include /etc/modsecurity/blacklist.conf
#Bad hosts, bad proxies and other bad players
##Include /etc/modsecurity/blacklist2.conf
#Bad clients, known bogus useragents and other signs of malware
##Include /etc/modsecurity/useragents.conf
#Known bad software, rootkits and other malware
##Include /etc/modsecurity/rootkits.conf
#Signatures to prevent proxying through your server
#only rule these rules if your server is NOT a proxy
##Include /etc/modsecurity/proxy.conf
#Just in Time Patching for Vulnerable Applications
##Include /etc/modsecurity/jitp.conf
#Google Hacks signatures
##Include /etc/modsecurity/recons.conf
#Include /etc/modsecurity/
</IfModule>
I have a VPS with 256m guaranteed RAM .. and I have CPanel. A couple of days ago I got to fiddling with a database issue and had phpMyAdmin open for the better part of an hour. So I got to wondering what something like that does to my VPS?
A secondary question .. same thing but on a dedicated server with 1g RAM?
guys im tired off fighting those hackers everyday! i have about 20 websites,and everyday i have one of them hacked! i restore a backup then another one hacked!
thats unbelivable!!!
those bastards upload there shell scripts to websites via bugs or whatever from php files!!
is there anyway to stop these commands?
can .htaccess helps? how?
i talked to my webhosting companies for my websites! ....
Virtuozzo 3.0 is killing VPS's /usr/bin/mysqld_safe process but leaving /usr/sbin/mysqld UP which is causing cPanel to be unable to automatically restart MySQL after that.
View 14 Replies View RelatedOne of these rules is causing name server lookups to fail, but I can't seem to figure out which one, can anyone spot the problem?
Code:
[root@example ~]# iptables -L -n
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
INVDROP all -- 0.0.0.0/0 0.0.0.0/0 state INVALID
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x05/0x05
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x11/0x01
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x18/0x08
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x30/0x20
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:20
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:21
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:110
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:143
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:443
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:465
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:953
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:993
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:995
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:10023
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:20
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:21
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:953
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:53 dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53 dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:53 dpts:1024:65535
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53 dpts:1024:65535
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spts:1024:65535 dpt:53
LOGDROPIN all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
INVDROP all -- 0.0.0.0/0 0.0.0.0/0 state INVALID
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x05/0x05
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x11/0x01
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x18/0x08
INVDROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x30/0x20
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:20
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:21
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:110
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:113
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:443
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:953
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:10023
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:9999
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:20
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:21
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:113
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:123
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:953
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:53 dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53 dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spts:1024:65535 dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:53 dpts:1024:65535
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53 dpts:1024:65535
LOGDROPOUT all -- 0.0.0.0/0 0.0.0.0/0
Chain INVDROP (18 references)
target prot opt source destination
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain LOGDROPIN (1 references)
target prot opt source destination
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:67
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:68
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:68
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:111
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:111
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:113
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:113
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpts:135:139
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpts:135:139
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:445
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:445
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:513
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:513
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:520
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:520
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 30/min burst 5 LOG flags 0 level 4 prefix `Firewall: *TCP_IN Blocked* '
LOG udp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 30/min burst 5 LOG flags 0 level 4 prefix `Firewall: *UDP_IN Blocked* '
LOG icmp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 30/min burst 5 LOG flags 0 level 4 prefix `Firewall: *ICMP_IN Blocked* '
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain LOGDROPOUT (1 references)
target prot opt source destination
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 30/min burst 5 LOG flags 0 level 4 prefix `Firewall: *TCP_OUT Blocked* '
LOG udp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 30/min burst 5 LOG flags 0 level 4 prefix `Firewall: *UDP_OUT Blocked* '
LOG icmp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 30/min burst 5 LOG flags 0 level 4 prefix `Firewall: *ICMP_OUT Blocked* '
DROP all -- 0.0.0.0/0 0.0.0.0/0
My nobody_check is killing a process that seems to be o.k. but I'm not sure. The process is running /usr/bin/perl-bin which I never heard of. I thought it was /usr/bin/perl
Should I be concerned? Again, I don't know what /perl-bin is.
Process ID: 28457 has been killed
Restuls for PID: 28457
total 0
dr-xr-xr-x 3 nobody nobody 0 Jul 23 17:00 .
dr-xr-xr-x 201 root root 0 Jun 29 11:59 ..
dr-xr-xr-x 2 root root 0 Jul 23 17:00 attr
-r-------- 1 root root 0 Jul 23 17:00 auxv
-r--r--r-- 1 root root 0 Jul 23 17:00 cmdline
lrwxrwxrwx 1 root root 0 Jul 23 17:00 cwd -> /
-r-------- 1 root root 0 Jul 23 17:00 environ
lrwxrwxrwx 1 root root 0 Jul 23 17:00 exe -> /usr/bin/perl-bin
dr-x------ 2 root root 0 Jul 23 17:00 fd
-rw-r--r-- 1 root root 0 Jul 23 17:00 loginuid
-r-------- 1 root root 0 Jul 23 17:00 maps
-rw------- 1 root root 0 Jul 23 17:00 mem
-r--r--r-- 1 root root 0 Jul 23 17:00 mounts
lrwxrwxrwx 1 root root 0 Jul 23 17:00 root -> /
-r--r--r-- 1 root root 0 Jul 23 17:00 stat
-r--r--r-- 1 root root 0 Jul 23 17:00 statm
-r--r--r-- 1 root root 0 Jul 23 17:00 status
dr-xr-xr-x 3 root root 0 Jul 23 17:00 task
-r--r--r-- 1 root root 0 Jul 23 17:00 wchan
Netstat:
tcp 0 0 127.0.0.1:783 127.0.0.1:40957
CLOSE_WAIT 28457/spamd child
udp 0 0 xx.xxx.xxx.xx:41008 216.52.190.1:53
ESTABLISHED 28457/spamd child
unix 3 [ ] STREAM CONNECTED 120878416 28457/spamd
child
unix 2 [ ] DGRAM 120872220 28457/spamd
child
unix 2 [ ] STREAM CONNECTED 120847759 28457/spamd
child
unix 2 [ ] STREAM CONNECTED 120832442 28457/spamd
child
Environ:
Process ID: 23944 has been killed
Restuls for PID: 23944
total 0
dr-xr-xr-x 3 nobody nobody 0 Jul 23 16:55 .
dr-xr-xr-x 206 root root 0 Jun 29 11:59 ..
dr-xr-xr-x 2 root root 0 Jul 23 17:00 attr
-r-------- 1 root root 0 Jul 23 17:00 auxv
-r--r--r-- 1 root root 0 Jul 23 16:55 cmdline
lrwxrwxrwx 1 root root 0 Jul 23 17:00 cwd -> /
-r-------- 1 root root 0 Jul 23 17:00 environ
lrwxrwxrwx 1 root root 0 Jul 23 16:55 exe -> /usr/bin/perl-bin
dr-x------ 2 root root 0 Jul 23 17:00 fd
-rw-r--r-- 1 root root 0 Jul 23 17:00 loginuid
-r-------- 1 root root 0 Jul 23 17:00 maps
-rw------- 1 root root 0 Jul 23 17:00 mem
-r--r--r-- 1 root root 0 Jul 23 17:00 mounts
lrwxrwxrwx 1 root root 0 Jul 23 17:00 root -> /
-r--r--r-- 1 root root 0 Jul 23 16:55 stat
-r--r--r-- 1 root root 0 Jul 23 16:55 statm
-r--r--r-- 1 root root 0 Jul 23 16:55 status
dr-xr-xr-x 3 root root 0 Jul 23 17:00 task
-r--r--r-- 1 root root 0 Jul 23 17:00 wchan
Netstat:
tcp 1 0 127.0.0.1:783 127.0.0.1:40955
CLOSE_WAIT 23944/spamd child
udp 0 0 xx.xx.xxx.xxx:55606 216.52.190.1:53
ESTABLISHED 23944/spamd child
unix 3 [ ] STREAM CONNECTED 120847760 23944/spamd
child
unix 2 [ ] STREAM CONNECTED 120832442 23944/spamd
child
unix 2 [ ] DGRAM 120677444 23944/spamd
child
Environ:
So we've got a client setup with 2 domains; 1 main and 1 secondary.
The secondary domain is a 301 redirect with masking through GoDaddy. The reason for the masking is because we need the domain name to stay the same after the redirect. (So people who come in on DomainB will only see DomainB in the url bar.)
The problem: GoDaddy has uses a "zero frame" element to implement the masking and it's messing up the display of our site.
Note: The display only screws up in IE.
Primary domain: www.BristolCountyWomensJournal.com --> (This works fine.)
301 domain: www.WomensJournals.com --> (Check out the messy background!)
Anyone know of alternatives to Domain Masking?
My httpd server continuosly failing i have to set or restart it manually how can i set auto incase if its restart failed.
View 11 Replies View Relatedas default,we may install all the feature on the server,
but i find some shared hosting server provider install web httpd on the front,
and mysql on another one,
could you share your experience about how do you do now?
my server will revert to its old host name and stop working. Old host name was (in) and the new one is (zonto). Then, the server will eventually crash HTTPD. There is enough ram, there is small cpu usage. HTTPD is restarted and then it says it can't connect to local host blah blah. I checked EVERYWHERE, the new host name is set. Is there a host name issue some where else? I change it via the hostname command and changed all of the files.
View 14 Replies View RelatedI am not being able to restart the server, or MySQL or httpd via SSH.
PHP Code:
root@server [~]# /etc/init.d/httpd fullstatusLooking up localhostMaking HTTP connection to localhostAlert!: Unable to connect to remote host.lynx: Can't access startfile http://localhost/server-statusroot@server [~]#
PHP Code:
root@server [~]# /etc/init.d/mysql reload/etc/init.d/mysql: line 244: kill: (3375) - No such processtouch: cannot touch `/var/lib/mysql/server.lubnan.us.pid': Read-only file system
For my website I have a server which houses all of my gallery IMAGES of my user profiles. There are over 100,000 images on the server and it's only purpose is to provide those images with http.
However, the http server also has PHP installed, and it's only purpose is for uploading new images. Therefore users eventually get redirected to the images server where they can upload the image.
This all works, but in the future I want to remove the PHP side to the server. I also want to change the whole server program from Apache to Lighthttpd. This is because, lighthttp is a very low overhead web server program, but also provides very little features.
So I was wondering, if I was to do so, and since PHP is not installed, then I would have to make the upload pages on the main http server (which has PHP and Apache). Then I would have to make the main server send the uploaded image to the the lighthttp server via some sort of the scp system call, via PHP. I know that this IS possible, but when it comes down to security holes and so on, would this method really be worth it?
Generally I want to have the lighthttp setup only because it eliminates having to have any dynamic content. Obviously this can also be done with apache (removing dyanmic content), but lighthttp may be more efficient for static content.
As you can see.. there are LOT of connections, checked the network traffic with the NOC, and there is no attack to this server, also, load average is just fine ( fine to handle thos 24000 connections ) :
Code:
top - 16:22:06 up 1 day, 4:10, 1 user, load average: 2.35, 1.92, 1.80
Tasks: 486 total, 3 running, 483 sleeping, 0 stopped, 0 zombie
Cpu(s): 18.1% us, 15.8% sy, 0.0% ni, 57.8% id, 8.0% wa, 0.3% hi, 0.0% si
Mem: 2074864k total, 2057424k used, 17440k free, 28292k buffers
Swap: 2048276k total, 536k used, 2047740k free, 1254496k cached
Code:
[root@server.com~]netstat -an | grep :80 | awk '{ print $5 }' | awk -F: '{ print $1 }' | sort | uniq -c | sort -n
1 165.98.162.70
1 189.131.41.44
1 189.148.21.71
1 189.162.12.79
1 190.40.197.20
1 190.40.221.8
1 190.42.165.10
1 190.56.52.170
1 190.82.40.239
1 190.83.16.78
1 190.86.112.232
1 196.218.61.109
1 200.0.251.141
1 200.107.182.157
1 200.117.132.42
1 200.127.9.187
1 200.127.93.33
1 200.26.154.213
1 200.45.154.172
1 200.45.95.106
1 200.55.33.114
1 200.64.167.167
1 200.65.120.103
1 200.65.224.31
1 200.65.90.116
1 200.81.215.68
1 200.86.145.51
1 200.91.196.101
1 201.13.148.63
1 201.216.210.81
1 201.217.21.18
1 201.221.165.235
1 201.223.163.188
1 201.223.58.53
1 201.225.168.66
1 201.229.227.19
1 201.232.67.214
1 201.252.177.89
1 201.42.47.152
1 201.66.167.80
1 208.35.120.69
1 213.230.57.171
1 213.99.203.36
1 217.15.46.97
1 41.250.35.182
1 62.57.223.4
1 64.12.116.198
1 66.50.4.169
1 70.157.51.76
1 80.103.194.241
1 80.103.244.9
1 80.35.105.72
1 81.167.76.64
1 81.172.59.38
1 81.184.125.159
1 81.42.136.159
1 83.175.216.139
1 83.34.75.215
1 83.40.177.122
1 83.56.243.100
1 83.61.202.162
1 84.172.114.77
1 84.76.47.159
1 84.78.51.134
1 85.59.105.82
1 85.59.44.144
1 85.84.196.176
1 87.217.248.132
1 87.9.3.227
1 88.13.59.80
1 88.14.151.83
1 88.243.44.243
1 88.6.193.57
1 89.52.119.106
1 91.5.25.69
2 148.240.103.239
2 148.240.106.145
2 189.160.98.131
2 189.164.91.133
2 190.24.64.111
2 190.5.196.42
2 195.159.192.94
2 195.160.204.167
2 200.122.26.161
2 200.255.166.196
2 200.58.31.210
2 200.65.200.61
2 200.81.220.213
2 200.82.241.167
2 201.20.119.160
2 201.228.198.9
2 201.228.81.192
2 201.240.236.4
2 201.243.14.219
2 62.83.224.234
2 69.134.194.23
2 80.58.205.32
2 81.36.149.153
2 82.158.193.220
2 83.29.165.39
2 83.33.149.36
2 84.202.151.213
2 85.201.148.63
2 87.19.141.251
3 189.162.4.190
3 190.40.133.222
3 190.6.165.21
3 190.65.7.162
3 200.116.118.133
3 217.216.179.124
3 62.141.241.95
3 83.147.147.5
3 84.18.27.169
3 84.32.123.132
3 84.43.139.236
3 88.226.253.180
3 88.7.73.248
4 189.149.5.151
4 189.158.190.132
4 190.20.81.151
4 200.124.163.127
4 88.244.203.111
5 201.240.15.181
8 212.163.9.11
38 201.143.175.190
46 190.82.179.24
24537
85 % of this apache requests, are in TIME_WAIT state as:
Code:
tcp 0 0 ::ffff:SERVERIP:80 ::ffff:85.48.70.56:49910 TIME_WAIT
tcp 0 0 ::ffff:SERVERIP:80 ::ffff:81.44.96.178:10681 TIME_WAIT
tcp 0 0 ::ffff:SERVERIP:80 ::ffff:200.106.71.33:15028 TIME_WAIT
tcp 0 0 ::ffff:SERVERIP:80 ::ffff:200.106.71.33:15028 TIME_WAIT
tcp 0 0 ::ffff:SERVERIP:80 ::ffff:66.201.171.211:20470 TIME_WAIT
tcp 0 0 ::ffff:SERVERIP:80 ::ffff:81.37.198.134:29218 TIME_WAIT
tcp 0 0 ::ffff:SERVERIP:80 ::ffff:83.52.36.230:28849 TIME_WAIT
Also, dmesg shows this.
Code:
ip_conntrack: table full, dropping packet.
printk: 643 messages suppressed.
ip_conntrack: table full, dropping packet.
printk: 844 messages suppressed.
ip_conntrack: table full, dropping packet.
printk: 665 messages suppressed.
ip_conntrack: table full, dropping packet.
printk: 755 messages suppressed.
ip_conntrack: table full, dropping packet.
printk: 667 messages suppressed.
ip_conntrack: table full, dropping packet.
printk: 735 messages suppressed.
ip_conntrack: table full, dropping packet.
printk: 664 messages suppressed.
ip_conntrack: table full, dropping packet.
printk: 760 messages suppressed.
ip_conntrack: table full, dropping packet.
printk: 666 messages suppressed.
ip_conntrack: table full, dropping packet.
printk: 606 messages suppressed.
ip_conntrack: table full, dropping packet.
printk: 723 messages suppressed.
ip_conntrack: table full, dropping packet.
ip_tables: (C) 2000-2002 Netfilter core team
ip_conntrack version 2.1 (8192 buckets, 65536 max) - 340 bytes per conntrack
printk: 257 messages suppressed.
I already tried to ha handle this using: echo "65535" > /proc/sys/net/ipv4/ip_conntrack_max, but the problem stills.
Im using a plain redhat es 4 server, latest kernel-smp, apache 2.x with mod_evasive.
I have a server that has server load showing at 25-40 (once it was even 53!), running like that for hours. The server has 4 cpus - and yet the sites on the server seem to run fine when I check them. What I'm wondering is, what exactly is load in this context; and how can load run so high like that without the server crashing?
According to top, the load is caused by httpd processes running under user 'nobody', that often take up double digit CPU percentage.
Does Apache always run under 'nobody'?
Is there any way to trace an httpd processes - which account it's for, or which physical script or URL is calling it?
And for top itself, the TIME field on one server of mine is in the format xx:xx (e.g. 3:25), on another it's TIME+ and in the format xx:xx.xx (e.g. 30:02.77). What exactly does this mean? I would asume it's minutes:seconds and minutes:seconds:hundredths, but while watching top it doesn't seem to correlate with that.
a topic long time ago that my server load is frequently high.
I'm talking about something like this
Server Load 158.86
Memory Used 28.2 %
Swap Used 99.57 %
[url]
The only way to solve this problem is to identify the load earlier and kill all httpd process. What I did was
#killall -9 httpd
#killall -9 httpd
#killall -9 httpd
x 30~40 times until no pid process found & the server load is back to normal.
On previous thread, I tried to update mysql & php and it works,
Right now again I am experiencing high server load again...
I'm very sure it's caused by httpd but I am still unable to find out the real cause of the problem and which account user is the culprit for causing this high load.
Can someone assist me by telling me where/how to begin with?
My Dedicated server is being slow - hopefully someone can give a helping hand
Processor: AMD Single CPU Dual Core Athlon 4200
Memory: 2048MB RAM
Primary Hard Drive: 160GB
Operating System : CentOS 4.x X86_64 Bit
Control Panel: CPanel
uplink port: 100
Apache version 1.3.37
php 4.4.4
When i go to my website or any page under the domain it's just white. Blank nothing, nada.
"Failed to receive status information from Apache. Unable to connect to local httpd server."
This error message appears when i click on "apache status".
Is this because of the network issue? Or is it because of something I did myself?
I did a google search and came up on some solution, I did them and nothing.
We have a VPS Server from one of the most reputable VPS Provider. We have 384 Guaranteed RAM and 1GB Burst. We have Dual Core AMD Opteron(tm) Processor 265 - 1795.503 MHz with 1024 KB cached allocated to our VPS.
It is only hosting 2 average forums (10-15 concurrent users in total) and 30 small websites, low traffic websites.
The problem we are having is, almost 3 times a week, the cPanel, named and apache services keeps stopping. I am monitoring our server when this is happen and prior to the event its only using about 300MB RAM and low CPU..
What could be causing this problem? Do I need to upgrade our RAM?
Our server is running; Plesk 11.0.9 and CentOS 5.7 it has a Q8200 CPU @ 2.33GHz and 2GB of RAM. Now there are just two websites on the server plus a couple of redirects/forwarding domains, although lots of domains are still on the server but turned off in Plesk. Both websites are OSCommerce sites and I just need to keep these sites going until the end of the year when we will switch to our new Joomla based website.
We have seen an increasing number of server crashes and after various checks of the logs, fitting a new BIOS battery, check of the hardware by EasySpace who host the server, installation of ClamAV, LMD and RKHunter (which did find some Trojans and Suspect software), I have traced it down to some external Http activity that is taking all of my CPU time and RAM. Here is a screen capture of the Htop listing and when I killed these processes the CPU and RAM went back to normal. The problem is that I usually have to restart the HTTPD service and sometimes things get so bad that the server crashes and I have to request a power cycle.