server overloads

[scriptlisters]

Twice per day my server load is going through the roof. The period of overload last about 30 minutes, somtimes longer. Yesterday the server reached a load of 60!

Theres only a few active sites on the server and they aren't causing the load problems, as i've had the server running fine with more active sites on it. I can't for the life of me work out what is causing it.

Has anyone got any suggestions on what could be causing it?

I'm using centos 2.6.9-22.EL #1 and I've attached a screenshot of top to see if that helps.

Thanks in advance

[jayh38]

VPS? If not, upgrade the ram for starters. 2GB would be nice.

[scriptlisters]

no, its a dedi, apart from ram what else could cause it? I know it could do with more ram but its been doing fine with more sites which were active on it.

[nyjimbo]

Are most of those 260+ processes HTTPD tasks?. You need to run an "apache status" in WHM to see whats going on there and also do some netstat's to see if its an attack. It could be a bad crawler, a mysql attack, etc..

However it would be nice to know how much ram you have as it seems like you are swapping alot and we dont know how much actual ram you have.

[scriptlisters]

Its running on 512mb ram

Do i check the apache staus when the server load has gone high or do i just do it anytime? cos right now the load has went back to normal and most processes are apache, but i'm not sure if thats the case when it goes crazy!

What am i looking for in netstat to know if ots an attack or a bad crawler?

Thanks for responding and helping!

[nyjimbo]

Its running on 512mb ram

Do i check the apache staus when the server load has gone high or do i just do it anytime? cos right now the load has went back to normal and most processes are apache, but i'm not sure if thats the case when it goes crazy!

What am i looking for in netstat to know if ots an attack or a bad crawler?

Thanks for responding and helping!

Well I hate to tell you but first off 512mg is barely enough ram to make the machine fully functional with all the applications, httpd requests, email bombing runs, etc..

Once you run out of ram and start swapping the system becomes unpredicable. Things take 10 times as long to complete (not an exact number) and loads go through the roof.

But you could be seeing a apache attack so doing the apache status DURING the heavy load times is critical to see if it is in fact something apache is serving back, it could even just be a bad robot eating your sites and not following normal rules including obeying robots.txt files.

'netstat -m' will show if you are being hammered and memory buffers are being eaten up even though you might not see the requests on the apache status.

'netstat -a' will show you the state of all sockets.

Post some results of these during heavy loads and we might be able to get an idea what is going on.

[scriptlisters]

Ok, it'll probably start tonight again round about 11pm to midnight, (GMT) I'll post them and check back tommorow, and see what you think.

Thanks