my server load was increased unexpected because exim

[d4nt3w]

our normal load of 1 to 4 tops, was increased recently to 20 or 45. Apparently there is no any attacks but I was forced to replace courier by dovecot, overload is generated by exim most of that.
I don´t have new users, tomorrow it´s going to be a week since this issue appears.
Please help, our users are going to make me crazy

[brianoz]

I'd like to help but you haven't told us anything really about what's happening. We need to know details, like how many emails in the queue, how many going through server, is it all spam etc etc etc ...

[PlatinumServerM]

To start with, look at the cpu processes in whm and see what is running. That will give you an idea of what is causing the load.

[thewebhosting]

May be you need to look at the nobody processes. Run below command to get the list of running nobody processes:

ps -auxf | grep nobody

Please be informed that apache runs as nobody user, so do not confuse about httpd processes. They are legit processes.

Also, check in /tmp and /home/tmp for the suspicious files.

[JPC-Shaun]

There can be many reasons of high load on the server. First of all try to find out whether the problem is due to high HTTP traffic or some spam/bulk mail activity going on the server. You should look into the exim_main logs the exim mail queue and tail the apache logs , also note the time when the load on the server goes high , there may be some cron job implemented which runs at some specific time and consumes resources. There can be some mysql queries also that are not optimized and consuming resources.

[thewebhosting]

Also, check apache error logs or access logs. Is any firewall installed on your server. I would recommend to install CSF firewall. We are using it and getting better results.

[brianoz]

ps -auxf | grep nobody

Actually a more useful command for gauging server performance is the following:

ps -efH | less

The "H" option sorts processes by which started which, meaning you get a nicely ordered list of processes which is a LOT easier to understand. For instance, you get all the httpd processes in one bunch, with any PHP children attached, etc.

[thewebhosting]

Ok thanks for providing this information! it's very useful

[d4nt3w]

You are a great technical support team
Thank you for your helpful information.