CPU Usage in Apache Server Status

sten88

Verified User
Joined
Feb 22, 2018
Messages
23
Hello.

After updating Apache to the latest version via custombuild (most likely afterwards), on the Apache Server Status page I noticed that in the CPU Usage line, the increased values and% CPU load. (Example: CPU Usage: u62.32 s15.75 cu24693.5 cs3593 .31 - 59.6% CPU load) Periodically the CPU load can reach 2000%! Previously, this indicator was approximately: u46.73 s265.5 cu0 cs0 - .253% CPU load
Thus Server load in norm (0.39 0.46 0.53, etc.)

The question is whether this is normal, what can influence and how to reduce if it is required?

Thank you.

It was:
https://ibb.co/kXqbBp
Became:
https://ibb.co/hT2L49
 
Last edited:
Hello,

Check web-server logs, and apache server status page.

It might be

- brute-force attacks
- spam-bot attacks
- http flood
- dos
- etc

For example recently found bots trying various pages and searching vulnerabilities, i wonder if you have the same

Code:
grep CHAR /var/log/httpd/domains/*log | grep -v error.log

related:

- https://help.directadmin.com/item.php?id=91
 
Hello. Thank you for your reply.
In the server logs I did not find anything suspicious.
On the executed command:
Code:
grep CHAR /var/log/httpd/domains/*log | grep -v error.log
I actually found several requests from one site. Opening its log, I saw that really, it seems like an influx of bots.
After locking for a while, and rebooting the Apache, the load dropped to 10%.
What load can be allowed? How to solve this problem in general? To protect yourself? Thank you.
 
It seems to me, it's not really possible in bots.
Here is an indicator during the night recount of directadmin.
https://ibb.co/k3f8Rp
Is it possible? Is it still an inconsistent indicator?
Perhaps this is due to the update?
What do you think?
 
I rely on logs and other data which can be collected from the server. I don't play guess games, the latest is not very reliable.

If you need a help you need to provide as much details as possible, or hire somebody to investigate it on your server.

I use:

- web-server logs and grep,
- mail-server logs and exigrep
- apache server status page
- top/htop/ps
- mysqladmin
- custom scripts
- etc

and search for possible patterns in logs
 
Back
Top