httpd high load

rmxs · Feb 9, 2008

hello i get high cpu load from httpd

here is the top

Code:

[root@servers ~]# top
top - 13:33:57 up 29 min,  2 users,  load average: 5.07, 4.49, 3.58
Tasks:  73 total,   4 running,  69 sleeping,   0 stopped,   0 zombie
Cpu(s):  9.2% us,  4.1% sy,  0.0% ni, 86.7% id,  0.0% wa,  0.0% hi,  0.0% si
Mem:   1536000k total,   791996k used,   744004k free,        0k buffers
Swap:        0k total,        0k used,        0k free,        0k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
23562 apache    15   0 31928  19m 3772 S    5  1.3   0:00.15 httpd
24099 root      25   0  8852 5196 1552 R    1  0.3   0:00.04 cc1
23996 root      19   0  2824 1752  904 S    1  0.1   0:00.03 sh
 3959 apache    15   0 24760  12m 4036 S    0  0.9   0:01.57 httpd
32181 apache    15   0 30788  18m 4040 S    0  1.3   0:02.04 httpd
    1 root      15   0  1696  608  520 S    0  0.0   0:00.07 init
 1449 mysql      6 -10  544m  66m 2636 S    0  4.4   0:02.10 mysqld
 1452 mysql      6 -10  544m  66m 2636 S    0  4.4   0:03.31 mysqld
 1664 mysql      5 -10  544m  66m 2636 S    0  4.4   0:02.69 mysqld
 1674 mysql      5 -10  544m  66m 2636 S    0  4.4   0:02.54 mysqld
 1693 mysql      5 -10  544m  66m 2636 S    0  4.4   0:03.23 mysqld
 1697 mysql      5 -10  544m  66m 2636 S    0  4.4   0:01.87 mysqld
 1718 mysql      5 -10  544m  66m 2636 S    0  4.4   0:04.48 mysqld
 1787 named     23   0 67176 2908 1880 S    0  0.2   0:00.04 named
 3844 apache    15   0 24796  12m 3856 S    0  0.9   0:02.12 httpd
 3944 apache    15   0 24772  12m 3860 S    0  0.8   0:00.63 httpd
 3948 apache    15   0 24788  12m 4016 S    0  0.9   0:00.69 httpd
 5173 nobody    15   0  7008  608  268 S    0  0.0   0:00.00 directadmin
 5283 nobody    15   0  7008  608  268 S    0  0.0   0:00.00 directadmin
 7942 root      22   0  1648  696  536 S    0  0.0   0:00.00 make
 7943 root      23   0  2172  988  856 S    0  0.1   0:00.00 sh
 7952 root      23   0  2172  544  412 S    0  0.0   0:00.00 sh
 7953 root      25   0  1652  696  552 S    0  0.0   0:00.00 make
 7954 root      25   0  2176  988  856 S    0  0.1   0:00.00 sh
 7959 root      25   0  2176  548  412 S    0  0.0   0:00.00 sh
 7961 root      25   0  1780  836  568 S    0  0.1   0:00.00 make
 7962 root      25   0  2168  992  860 S    0  0.1   0:00.00 sh
 7968 root      17   0  1912  920  572 S    0  0.1   0:00.01 make
 9480 apache    15   0 24792  12m 3860 S    0  0.9   0:00.77 httpd
 9514 apache    15   0 24804  12m 3904 S    0  0.9   0:01.83 httpd
 9516 apache    15   0 24792  12m 3848 S    0  0.8   0:00.59 httpd
 9569 apache    15   0 25468  13m 4008 R    0  0.9   0:00.27 httpd
10187 nobody    16   0  7008  608  268 S    0  0.0   0:00.00 directadmin
14039 apache    15   0 24740  12m 3864 S    0  0.8   0:00.97 httpd
15825 apache    15   0 24788  12m 4072 S    0  0.9   0:07.79 httpd
16015 apache    15   0 24788  12m 3864 S    0  0.9   0:00.59 httpd
16019 apache    15   0 24776  12m 3848 S    0  0.8   0:00.79 httpd
16036 apache    15   0 24784  12m 4064 S    0  0.9   0:00.33 httpd
16038 apache    15   0 24732  12m 3972 S    0  0.9   0:00.57 httpd

apache 2.2.8
i have build with custom build everything (im running the new versions)

Can someone tell me what can cause this?

rmxs · Feb 9, 2008

apache path that make the load its this /usr/sbin/httpd -k start -DSSL i thing its the https (perl)????

How can i dissable this.?

andyreed · Feb 9, 2008

rmxs said:
apache path that make the load its this /usr/sbin/httpd -k start -DSSL i thing its the https (perl)

Apache v2.x uses '/usr/sbin/httpd -k start' or 'httpd -k start -DSSL' (apachectl calls this so no one would really notice a difference as it's automatically called from the init scripts).

Since you are using apache v2.x this is normal Apache process and has nothing to do with your high server load: Read this for more info about such process: http://httpd.apache.org/docs/2.2/programs/httpd.html

Seek professional help to secure and harden your server. I see few interesting processes running on your server such as: cci, sh, and make.

rmxs · Feb 10, 2008

thanks for you reply..

Seek professional help to secure and harden your server. I see few interesting processes running on your server such as: cci, sh, and make.

this processes its there because i try to rebuild the apache from onother ssh.(i thing its normal when you build)

here is onother one shoot

top - 03:29:40 up 7 min, 1 user, load average: 4.09, 2.49, 1.10
Tasks: 75 total, 8 running, 67 sleeping, 0 stopped, 0 zombie
Cpu(s): 25.1% us, 7.3% sy, 0.0% ni, 67.6% id, 0.0% wa, 0.0% hi, 0.0% si
Mem: 1536000k total, 393180k used, 1142820k free, 0k buffers
Swap: 0k total, 0k used, 0k free, 0k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
7809 apache 25 0 25588 13m 4008 R 11 0.9 0:30.60 /usr/sbin/httpd -k start -DSSL
7953 apache 25 0 25488 13m 4016 R 10 0.9 0:09.49 /usr/sbin/httpd -k start -DSSL
7871 apache 15 0 24712 12m 3876 S 5 0.8 0:00.87 /usr/sbin/httpd -k start -DSSL
22279 apache 15 0 27332 15m 3940 R 3 1.0 0:00.17 /usr/sbin/httpd -k start -DSSL
7607 root 17 0 23624 11m 4300 S 1 0.8 0:00.29 /usr/sbin/httpd -k start -DSSL
22425 apache 15 0 23764 11m 3828 S 1 0.8 0:00.02 /usr/sbin/httpd -k start -DSSL
1 root 15 0 1696 604 520 S 0 0.0 0:00.18 init [3]
1611 nobody 18 0 7008 608 268 S 0 0.0 0:00.00 /usr/local/directadmin/directadmin d
1672 nobody 18 0 7008 608 268 S 0 0.0 0:00.00 /usr/local/directadmin/directadmin d
1868 nobody 18 0 7008 608 268 S 0 0.0 0:00.00 /usr/local/directadmin/directadmin d
3723 mysql 10 -5 140m 20m 2456 S 0 1.4 0:02.78 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/ser
4008 named 20 0 69204 2940 1884 S 0 0.2 0:00.03 named -u named
5497 nobody 18 0 7008 608 268 S 0 0.0 0:00.00 /usr/local/directadmin/directadmin d
5562 nobody 18 0 7008 608 268 S 0 0.0 0:00.00 /usr/local/directadmin/directadmin d
5582 root 16 0 7112 2264 1816 S 0 0.1 0:00.02 sshd: root@pts/0
5996 root 15 0 2352 1336 1056 S 0 0.1 0:00.01 -bash
7707 apache 15 0 24820 12m 4028 S 0 0.9 0:00.87 /usr/sbin/httpd -k start -DSSL
7714 apache 15 0 24712 12m 4052 S 0 0.9 0:02.21 /usr/sbin/httpd -k start -DSSL
7827 apache 15 0 24844 12m 3904 S 0 0.9 0:01.20 /usr/sbin/httpd -k start -DSSL
7939 apache 15 0 24848 12m 3980 R 0 0.9 0:01.43 /usr/sbin/httpd -k start -DSSL
13380 apache 15 0 24764 12m 3880 R 0 0.9 0:01.63 /usr/sbin/httpd -k start -DSSL
15432 apache 15 0 24716 12m 3856 S 0 0.8 0:00.43 /usr/sbin/httpd -k start -DSSL
17478 apache 16 0 23868 11m 3808 S 0 0.8 0:00.15 /usr/sbin/httpd -k start -DSSL
17479 apache 15 0 24112 11m 3752 S 0 0.8 0:00.59 /usr/sbin/httpd -k start -DSSL
17622 mysql 10 -5 140m 20m 2456 S 0 1.4 0:00.06 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/ser
17642 apache 15 0 24748 12m 3980 S 0 0.9 0:01.05 /usr/sbin/httpd -k start -DSSL
17646 mysql 10 -5 140m 20m 2456 S 0 1.4 0:00.07 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/ser
17690 mysql 10 -5 140m 20m 2456 S 0 1.4 0:00.40 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/ser
18200 mysql 11 -5 140m 20m 2456 S 0 1.4 0:00.02 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/ser
19534 rmxs 15 0 4800 1812 1020 S 0 0.1 0:00.04 proftpd: rmxs - 87.202.76.197: IDLE
22427 apache 15 0 24244 11m 3748 S 0 0.8 0:00.45 /usr/sbin/httpd -k start -DSSL
22504 apache 16 0 24020 11m 3708 S 0 0.8 0:00.11 /usr/sbin/httpd -k start -DSSL
22505 apache 15 0 24068 12m 4000 S 0 0.8 0:00.44 /usr/sbin/httpd -k start -DSSL
22510 apache 15 0 23988 11m 3736 S 0 0.8 0:00.54 /usr/sbin/httpd -k start -DSSL
24538 apache 15 0 23800 10m 3152 S 0 0.7 0:00.00 /usr/sbin/httpd -k start -DSSL
25610 apache 15 0 23764 11m 3328 R 0 0.7 0:00.00 /usr/sbin/httpd -k start -DSSL
26112 root 18 0 1952 1016 792 R 0 0.1 0:00.02 top
26154 apache 15 0 23624 10m 3088 S 0 0.7 0:00.00 /usr/sbin/httpd -k start -DSSL
26199 apache 15 0 23800 10m 3136 S 0 0.7 0:00.00 /usr/sbin/httpd -k start -DSSL

rmxs · Feb 10, 2008

i have try everything and this /usr/sbin/httpd -k start -DSSL running and make high cpu load ..its always first on the list..

this is ssl (i dont use ssl) so how can i stop this?

rmxs · Feb 10, 2008

i found this http://www.redoracle.com/index.php?option=com_exploit&task=view&type=webapps&exid=2973

Talking about a worm that run this proccess how can i check if is it or not?

nobaloney · Feb 15, 2008

4.09 and 5.07 are not high server loads for a reasonably provisioned server. This week we had some servers go over 400. At that point things begin to stop.

Why did you look at top? What were your symptoms?

Jeff

rmxs · Feb 16, 2008

my server now its ok..
I check some new files for bad coding and finally i fount one..

now its ok

Why did you look at top?

and were i can look

computerlady911 · Apr 11, 2008

apache won't start

After update I receive this error:

Code:

/sbin/service httpd start 2>&1

Tried build rewrite_confs

Got this

Code:

Done installing Apache+Mod_SSL.
Restoring certificate and key, and turning on httpd for DirectAdmins's check.
Restarting apache.
Stopping httpd:                                            [FAILED]
Starting httpd: fopen: No such file or directory
httpd: could not open document config file /etc/httpd/conf/extra/httpd-phpaddmodules.conf
                                                           [FAILED]
Using 207.158.61.3 for your server IP
make[1]: Entering directory `/usr/local/directadmin/custombuild/apache_1.3.41/src'
SSL Certificate Generation Utility (mkcert.sh)
Copyright (c) 1998-2000 Ralf S. Engelschall, All Rights Reserved.

Generating self-signed Snake Oil certificate [DUMMY]
______________________________________________________________________

RESULT: Server Certification Files

o  conf/ssl.key/server.key
   The PEM-encoded RSA private key file which you configure
   with the 'SSLCertificateKeyFile' directive (automatically done
   when you install via APACI). KEEP THIS FILE PRIVATE!

o  conf/ssl.crt/server.crt
   The PEM-encoded X.509 certificate file which you configure
   with the 'SSLCertificateFile' directive (automatically done
   when you install via APACI).

WARNING: Do not use this for real-life/production systems

make[1]: Leaving directory `/usr/local/directadmin/custombuild/apache_1.3.41/src'
Restarting apache.
Stopping httpd:                                            [FAILED]
Starting httpd: Syntax error on line 1 of /etc/httpd/conf/extra/httpd-phpmodules.conf:
Cannot load /usr/lib/apache/libphp5.so into server: /usr/lib/apache/libphp5.so: cannot open shared object file: No such file or directory
                                                           [FAILED]

computerlady911 · Apr 11, 2008

FIXED: I correct the options file

The options file was not correct. I fixed it and ran ./build all d and everything seems fine now.

httpd high load

rmxs

Verified User

rmxs

Verified User

andyreed

Verified User

rmxs

Verified User

rmxs

Verified User

rmxs

Verified User

nobaloney

NoBaloney Internet Svcs - In Memoriam †

rmxs

Verified User

computerlady911

Verified User

computerlady911

Verified User