Is this DDOS attack?

[Bahram0110]

Hello,
First of all, I apologize if thread location is not correct. Please move to related place.

I think my server is under DDOS attacks.
I installed PRM (rfxn.com) to limit resources.
sometimes prm send many emails about max process usage.. i.e. EVENT: HARD FAIL MAX_PROC use:70/max:30 (limit is 30 process pre user)

unfortunately all of this emails is send at same time and at least 95% of this alerts are for unused sites. So I'm sure that this is an attack.
But I can not find any suspicious connection in netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -n or suspicious process in top or process manager.

How can I find more about this and how can I conflict with it?

thank you

[Bahram0110]

In addition, Server load goes very high when this occur.
latest Centos 5.x, latest cpanel/whm, apache, mysql, cpu xeon 3220

[Bahram0110]

and attacks are for different users accounts at same time. WONDROUS!

[Bahram0110]

Hello,
any idea?

[dyelton]

I'm having the same thing happen on my server...did you figure anything out?

[Infopro]

Sounds like false positives to me:

sometimes prm send many emails about max process usage.. i.e. EVENT: HARD FAIL MAX_PROC use:70/max:30 (limit is 30 process pre user)

You might want to adjust your config a bit.

[a legacy reborn]

do you have ConfigServer Security & Firewall installed? I find it extremely useful for D/DoS.

[mayaboys]

Hello,

DDOS attacks are difficult to control, a good firewall as a first step and must be a hardware firewall that blocks 99% of attacks but is relatively expensive and is not offered by every provider.

Cordially

[cPanelTristan]

Hello,

I wanted to provide a link to a prior post that I did about a possible DDoS attack:

how to restart apache trough cpanel command line?

The tips in this post might be helpful for anyone reading this topic and needs assistance for a low-level denial of service attack to Apache.

Thanks.