Extreme CPU Load on Fedora

S

Sepivip

Verified User
Joined
Jan 19, 2007
Messages
33
Location
System32
Hi gr8 ppl

Here is my situation:

I run:

Fedora core 5 (32)
CPU: Core Duo
RAM: 4GB
HDD: 6 units of HDD, SATA, RAIDed, 250GB each
DA

I only run FILE HOSTING SCRIPT which is of course resource consuming script but I recieve very high CPU load, anything else seems to be normal.

Httpd:

Code: 
Timeout 200
KeepAlive On
MaxKeepAliveRequests 80
KeepAliveTimeout 7
MinSpareServers 5
MaxSpareServers 10
MaxClients 2000

PHP.INI

Code: 
max_execution_time = 360 
max_input_time = 360	
memory_limit = 32M 
post_max_size = 2000M
upload_max_filesize = 1000M
default_socket_timeout = 360

Thats all I modifed, everything else remains default.

and this is my stats after TOP command:



Code: 
Tasks: 291 total,   2 running, 289 sleeping,   0 stopped,   0 zombie
Cpu(s): 55.6% us, 22.2% sy,  0.0% ni, 11.1% id,  0.0% wa,  0.0% hi, 11.1% si,
Mem:   4126460k total,  3925804k used,   200656k free,    21728k buffers
Swap: 41928952k total,      144k used, 41928808k free,  3118812k cached
 Unknown command - try 'h' for help
  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
  451 root      10  -5     0    0    0 S    0  0.0  24:49.86 md1_raid5
17152 mysql     15   0  122m  27m 3296 S    0  0.7   4:13.61 mysqld
  193 root      15   0     0    0    0 S    0  0.0   1:19.30 kswapd0
  462 root      15   0     0    0    0 S    0  0.0   1:01.54 kjournald
 1869 named     15   0 52804 8268 2100 S    0  0.2   0:43.19 named
 2724 root       0 -20     0    0    0 S    0  0.0   0:26.53 loop0
23697 nobody    15   0 17240 7116 2336 S    0  0.2   0:13.90 httpd
26459 nobody    15   0 17232 7108 2336 S    0  0.2   0:13.81 httpd
23820 nobody    15   0 17156 7032 2336 S    0  0.2   0:12.97 httpd
25516 nobody    15   0 17208 7100 2336 S    0  0.2   0:12.91 httpd
23658 nobody    15   0 17184 6660 1920 S    0  0.2   0:12.00 httpd
25601 nobody    15   0 17208 6684 1920 S    0  0.2   0:11.61 httpd
26905 nobody    15   0 17212 6688 1920 S    0  0.2   0:11.41 httpd
23656 nobody    15   0 17216 6692 1920 S    0  0.2   0:11.37 httpd
23743 nobody    15   0 17212 6692 1924 S    0  0.2   0:10.94 httpd
23826 nobody    15   0 17232 7112 2340 S    0  0.2   0:10.89 httpd
26067 nobody    15   0 17136 6612 1920 S    0  0.2   0:10.68 httpd

why I get so many sleeping taks? what does it means? what would you recommend?

thank you in advance
 
What's load average? Lower MaxClients to 256, Timeout to 45, KeepAliveTimeout to 1-2. Set Min/MaxSpareServers value higher and after the changes restart the apache service.
 
Tried but still I recieve high loads, average is 30-40

after stopping apache, it drops to 0,1-0,2 and when I start it again it shifts again to 30 and up.
 
I guess that you're experiencing DDoS attack. Do this:
Code: 
cd /usr/local/src
wget http://www.gropp.org/bwm-ng/bwm-ng-0.6.tar.gz
tar -zxf bwm-ng-0.6.tar.gz
cd bwm-ng-0.6
./configure
make
make install
bwm-ng

What is is the total transfer in KB/s?

You should also want to activate server-status in /etc/httpd/conf/httpd.conf and take a look at it.

Also, I'd like to see the output of:
Code: 
netstat -n | grep :80 |wc -l
and
Code: 
netstat -n | grep :80 | grep SYN | wc -l
 
Thank u for reply

here is info you asked:

bwm-ng
untitled.JPG


netstat -n | grep :80 |wc -l

2762

netstat -n | grep :80 | grep SYN | wc -l
10


waiting for your reply.
 
You're really under DDoS attack. I suggest you installing mod_evasive, turining off KeepAlive and setting up MinSpareServers to 20 and MaxSpareServers 25.
 
smtalk

Thanks buddy, after your recommendations load on cpu lowered a bit, now average is 6-17, on the night it drops to 0.1

is that all I can do?
 
Tnx again Smtalk on that website I found this info:

Code: 
# wget http://www.inetbase.com/scripts/ddos/install.sh
# sh install.sh

is that all? it doesnt need any further configuration?

and 2 more questions if you are not to busy:

1. is there any way/tool/soft to detect DDoS attack, or offenders IPs?

2. which soft would you recommend for anaylising apache error log?

Thank you in advance
 
Yes, that's all. You can lower mod_evasive value in httpd.conf too.
 
I am really confused now, my visitors number rised and now my load average is 70-80... and sometimes even 100% or more... than I have to stop apache service and wait untill load drops to 0.2 and than start it again... cant explain why is this happening...
 
You must log in or register to reply here.
Back
Top