GZIP + Daily Backups = Daily Crashes..

[Devil Inside]

Howdy!

Alrighty - for the past week I've had to have the folks over at EV1 reboot my box since it's been crashing. From what I can tell it looks like it's caused by the daily backups.

I've noticed gzip burning up as much as 99% of the CPU power during backups.

Box specs:
Accounts - about 320 (low usage)
P4 3.06 GhZ
1GB RAM
2x 120 HDD
RHEL 3
Kernel 2.4.21-9.0.3.EL

Now - we've had this number of accounts on it for over a month. And have not been adding to it. And the crashing has just started about a week ago. Crashes occur during the morning between 6am - 12pm.

It's possible that stats are overlapping the time that backups are being done - so that may very well be a cause...

Any ideas on what I can do to help stablize this machine?

*EDIT*
Also - the cpu load on this machine is normaly between 0.3 - 1.5
And RAM usage is usually 30% - 60% (more towards 30 usually)
*/EDIT*

Thank you much!
TDI

[Rubas]

Hint:
Check logwatch - I had a similiar issue few weeks ago with almost daily crashes between 04-05 .

There was nothing in the log or somewhere else and I figured out it was logwatch.

Trick:
Make a cron job during this timeframe which sends you the top output as a mail to check the log theory.

[Devil Inside]

yeah but I get my logwatch at 4am every morning.

How would this cause the server to crash hours later?

Also - what I forgot to mention - I don't get my upcp email anymore now that the crashing has begun. And that email also contains the back up output.

[Rubas]

Originally posted by Devil Inside
yeah but I get my logwatch at 4am every morning.

How would this cause the server to crash hours later?

It was very strange .. the server goes offline for 20mins .. for 1h .. and sometimes forever @ 4.20... 4.50. 5.10 ...
Nothing in the logfiles or somewhere else - it was just a timejump in the logs.

Maybe you should try and deactivate the next few days the cronjob for logwatch - you have nothing to lose.

[Devil Inside]

yeah - I'll give it a shot...

err... where would I do that?