Very high i/o locks server.

[ozgurerdogan]

For last couple days, very high i/o causes DA stop responding? It might be a malware issue. But how can I first see which web site causes this? I have to reboot server each time this happens.

 

[Richard G]

Try commands like "top" to see what is using the most resources, and "ps faux" if you can see an account to a process which uses a lot.
Also install Maldetect:
http://forum.directadmin.com/showthread.php?t=45851
which is a good malware scanner.

And look in logfiles like /var/log/messages if you can find something there.

 

[ozgurerdogan]

Maldetect does not always detect malwares. top or ps faus also is not showing which web site user is using high io. I am trying apached extended loging (server-status)

 

[Richard G]

I know you can't always find things with Maldetect, top or ps faux, but it's a good begin.
Every system engineer should enable extended apache logging by default imho.

Another good option is to install a monitor program, in case it's hardware causing the issue. Munin for example.

 

[zEitEr]

Hello,

- iotop
- maldet+clamav+malware experts
- check swap status
- check mysql status
- /tmp, /var/tmp to tmpfs
- hdd to sdd

other.

 

[Richard G]

- maldet+clamav+malware experts

Malware experts? Do you have a link to their site/install?

 

[zEitEr]

https://forum.directadmin.com/showthread.php?t=53802