How do I find out what processes were causing high load?

[mcoms]

Hi,

I've just had a situation where a server became unreachable and had to be hard rebooted due to excessive load.

What tool could I use to find out what user / process was causing the load, or, could you please recommend any monitoring software I could install to alert me in the future?

Thanks for your help!

- Nick

[blessenonly]

Try using top command

-----------
Blessen
Your Server management Company

[AndyReed]

What tool could I use to find out what user / process was causing the load, or, could you please recommend any monitoring software I could install to alert me in the future?

This topic has been discussed many times in these forums. Search these forums using the phrase "high load", and just to mention a few: http://forums.cpanel.net/showthread.php?t=71786
http://forums.cpanel.net/showthread.php?t=67731
http://forums.cpanel.net/showthread.php?t=49110
Something causing high load

[mcoms]

blessenonly, thanks for your reply, however top will only help me if I can log in at the time of high load, not after the event.

ServerTune, thanks for the links, though not one of them discusses finding out what was causing load in the past.

Perhaps I should make my question clearer... A machine becomes unavailable due to high load and is rebooted. How, in the aftermath, do I find out what happened?

Cheers,
- Nick

[AndyReed]

Perhaps I should make my question clearer... A machine becomes unavailable due to high load and is rebooted. How, in the aftermath, do I find out what happened?

"That's the $64,000 question" This article will explain why: http://servertune.com/kbase/entry/67/

[nickp666]

sorry but andy, that was just a shameless plug, most people tend to know what possible causes of high load are, but this guy is asking how he looks around to find out what the cause was, nothing to do with the response you posted.

first place to start is /var/log/messages

look there for kernel panics/hardware warnings etc

also check for similar items in: dmesg
(type that at the shell)

check your exim logs for any mass of e-mail traffic, and check the output of ps aux just to make sure you have no rogue processes running

sometimes (although very rarely) the cpu/memory usage thing in WHM will give you a pointer (bare in mind though that it probably isnt accurate - just gives you some ideas of where to look)

If you have one, it will be worth looking at the process list when this happens, via a serial console, KVMoIP or DRAC

[rexrjacob]

Perhaps I should make my question clearer... A machine becomes unavailable due to high load and is rebooted. How, in the aftermath, do I find out what happened?

Cheers,
- Nick

If the server's load is spiking on a particular time everyday, the best option is to login to server before that and find the process causing issue using the
top -c command