How to find guilty process

[benito]

On one server i have a lot of httpd processes like usual, but since a few days there are two that hangs for hours. My load start rising when this happend and i have to kill those to slow down the load. After some time it happend again. How can i find the source of those two processes and what they are serving ?

6311 nobody    25   0 85432 9924 3788 R 32.5  1.0  55:20.43 httpd
22018 nobody    25   0 85424 9776 3648 R 30.2  1.0  41:22.21 httpd
 5902 nobody    15   0 85460 9712 3572 S  1.0  0.9   0:00.48 httpd
 8184 nobody    16   0 85864  10m 4304 S  1.0  1.1   0:00.32 httpd
11925 nobody    16   0 85340 8728 2692 S  1.0  0.8   0:00.04 httpd
12095 mailnull  19   0     0    0    0 Z  1.0  0.0   0:00.03 exim <defunct>
 5214 nobody    15   0 85448 9240 3088 S  0.7  0.9   0:00.60 httpd
 5400 nobody    15   0 85368 8864 2784 S  0.7  0.9   0:00.49 httpd
 5486 nobody    16   0 85372 8900 2820 S  0.7  0.9   0:00.47 httpd
 6108 nobody    15   0 85664 9556 3208 S  0.7  0.9   0:00.46 httpd
 6243 nobody    15   0 88436  11m 4676 S  0.7  1.1   0:00.42 httpd
 6969 nobody    15   0 85908  10m 3952 S  0.7  1.0   0:00.32 httpd
 8223 nobody    15   0 85368 8844 2772 S  0.7  0.9   0:00.22 httpd
 8310 nobody    15   0 85372 8896 2828 S  0.7  0.9   0:00.25 httpd
 8370 nobody    15   0 85364 8884 2812 S  0.7  0.9   0:00.20 httpd
11401 nobody    15   0 85376 8784 2716 S  0.7  0.9   0:00.09 httpd
11402 nobody    15   0 85840  10m 3872 S  0.7  1.0   0:00.17 httpd
11670 mailnull  16   0  9432 3460 2272 S  0.7  0.3   0:00.07 exim
11738 nobody    15   0 85356 8752 2692 S  0.7  0.9   0:00.10 httpd
14657 root      16   0 10620 6260 1196 S  0.3  0.6   0:30.10 mrtg
 9035 root      15   0  9092 2340 1864 S  0.3  0.2   0:00.58 sshd
 5246 nobody    15   0 89320  13m 3260 S  0.3  1.3   0:00.87 httpd
 5406 nobody    15   0 85436 9368 3224 S  0.3  0.9   0:00.51 httpd
 5644 nobody    15   0 85468 9284 3208 S  0.3  0.9   0:00.40 httpd
 6216 nobody    15   0 85372 8848 2772 S  0.3  0.9   0:00.51 httpd
 6856 nobody    17   0 85368 8988 2896 S  0.3  0.9   0:00.22 httpd
 6886 nobody    16   0 85448 9236 3092 S  0.3  0.9   0:00.29 httpd
 6920 nobody    15   0 85416 8868 2784 S  0.3  0.9   0:00.29 httpd
 8162 nobody    15   0 85384 8960 2888 S  0.3  0.9   0:00.23 httpd
 8371 nobody    15   0 85908  10m 3980 S  0.3  1.0   0:00.27 httpd
 8416 nobody    15   0 85848  10m 3972 S  0.3  1.0   0:00.31 httpd
11411 nobody    16   0 85380 8756 2692 S  0.3  0.9   0:00.08 httpd
11412 nobody    15   0 86660  13m 6240 S  0.3  1.3   0:00.53 httpd
11926 nobody    16   0 85296 8036 2048 S  0.3  0.8   0:00.01 httpd
11937 nobody    16   0 85388 8088 2072 S  0.3  0.8   0:00.02 httpd
11939 nobody    15   0 85352 8568 2608 S  0.3  0.8   0:00.01 httpd
11940 nobody    15   0 85340 8624 2640 S  0.3  0.8   0:00.03 httpd
11941 nobody    15   0 85348 8628 2640 S  0.3  0.8   0:00.03 httpd

[dafut]

Not sure if this is the best way, but if you run "netstat -tapn" in SSH, and find the associated PID, you may be able to figure out which site may be causing the problem by using the foreign address (might want to drop the -n switch to get the resolved domain). You can also pipe to a grep command that filters for PID/httpd or such.

Problem with above is that it will only show info if connection is established.

Hopefully, someone will have a better method they can share.

[xerophyte]

man lsof

lsof - list open files

[dafut]

Thanks xerophyte...