Slow Server Performance

[skullguy]

Hello,

I am a developer and have a dedicated server that was running fine, page loads fast, cpanel, loaded and navigated fine.

Now it's severly lagging, performance is slow everywhere. Webpage loads, email, even navigating cpanel.

What are the usual suspects to look at when diagnosing a performance issue?

Did the usual graceful, and forceful reboot and restarted apache... no difference...

The server farm people said they would take the server off line, and check the HD...

I think it may be something else... But, I'm not a server admin.
We running:
Intel Pentium 4 3.0Ghz
Fedora Core 6 Linux
1GB DDR-RAM
One 80GB SATA
100Mbps port - 1500Gb Bandwidth
We have 8 IPs, two for DNS, and one for our sites (75 sites)
All out sites are static, no SQL, - just tow flash forms.

Now were crawling, and need to diagnose, as general maintainence is now a problem.

Any help would greatly be appreciated.
If the suggestions are outside of what I can do, I'll forward to our admin. (which is most stuff)

Thanks,
Skullguy

[MaraBlue]

Hello,

I am a developer and have a dedicated server that was running fine, page loads fast, cpanel, loaded and navigated fine.

Now it's severly lagging, performance is slow everywhere. Webpage loads, email, even navigating cpanel.

What are the usual suspects to look at when diagnosing a performance issue?

Did the usual graceful, and forceful reboot and restarted apache... no difference...

The server farm people said they would take the server off line, and check the HD...

I think it may be something else... But, I'm not a server admin.
We running:
Intel Pentium 4 3.0Ghz
Fedora Core 6 Linux
1GB DDR-RAM
One 80GB SATA
100Mbps port - 1500Gb Bandwidth
We have 8 IPs, two for DNS, and one for our sites (75 sites)
All out sites are static, no SQL, - just tow flash forms.

Now were crawling, and need to diagnose, as general maintainence is now a problem.

Any help would greatly be appreciated.
If the suggestions are outside of what I can do, I'll forward to our admin. (which is most stuff)

Thanks,
Skullguy

Have you gone through standard troubleshooting first? Such as...did the slow-to-a-crawl happen gradually, or all at once? And if it happened suddenly, was there anything new installed? What's the bandwidth useage look like...has it suddenly spiked?

Do you have a firewall, and is it possible or have you checked for the possibility of trojans?

I'd do a basic security scan, if it hasn't been done already. And if it hasn't been done, I'd be looking to hire a new admin. My first inclination would be to check for something compromised on the server, either from an external source or one of your users.

[skullguy]

Have you gone through standard troubleshooting first? Such as...did the slow-to-a-crawl happen gradually, or all at once?

All at once

And if it happened suddenly, was there anything new installed?

The admin did a hardening..

What's the bandwidth useage look like...has it suddenly spiked?

Bandwidth? I doubt there was any spike in bandwidth... but not sure.

Do you have a firewall, and is it possible or have you checked for the possibility of trojans?

Pretty sure I have a firewall, the server farm i'm with has one as well that they said is good enough.

I'd do a basic security scan, if it hasn't been done already. And if it hasn't been done, I'd be looking to hire a new admin. My first inclination would be to check for something compromised on the server, either from an external source or one of your users.


Do you do admin?

Lets's talk.

Skullguy

[MaraBlue]

Have you gone through standard troubleshooting first? Such as...did the slow-to-a-crawl happen gradually, or all at once?

All at once

And if it happened suddenly, was there anything new installed?

The admin did a hardening..

Bingo!
Explain the problem you're having and have him or her go back over what he/she did.

Do you have a firewall, and is it possible or have you checked for the possibility of trojans?

Pretty sure I have a firewall, the server farm i'm with has one as well that they said is good enough.

"Good enough" is never good enough when security is at stake. There is an excellent one available for free from ConfigServer:

http://www.configserver.com/cp/csf.html

However, I wouldn't install anything until you have your admin go back over the hardening he/she did. CSF is an excellent firewall, but you do need to know what you're doing in order to install and configure it. It isn't difficult, and Chirpy (Jonathan, the developer of the firewall script) documents his work very well.

He also does server hardening, he is the ONLY admin I recommend (he's the only one beyond myself who touches my server), and information can be found on the website linked above.

The only (possible) drawbacks are that he's located in the UK and therefore in a different timezone than most of the US. I'm on the west coast, and that 8 hr time diff can be a pain in which to work around. Also, he's good so he's popular...in that he books up quick.

Sadly I have more horror stories than success stories on using other companies.

Do you do admin?

Lets's talk.

Skullguy

I do, but I'd first recommend contacting the person who did the hardening for you. I'm very hesitant to follow behind someone else's work when they should be the one to fix the problem for you (unless you had major problems with them, and/or don't trust them or their abilities), since it appears to be created by work they did.

That admin would know what they installed and how they configured the apps, and that would be your best bet (or at least your first stop) in solving the issue. Good luck!

[AndyReed]

All out sites are static, no SQL, - just tow flash forms.

Now were crawling, and need to diagnose, as general maintainence is now a problem.

What's your CPU/Server Load when the server goes very slow in speed? Login to the WHM >> Main >> Server Status >> Service Status

If the Server Load is not very high, it is likely that you are under some Internet attack. Read this article: http://servertune.com/kbase/entry/67/ and http://servertune.com/kbase/entry/64/

Although this is not the only command, or the ideal method, to judge, but run this command to see if you're under Syn Flooding attack:
/bin/netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr |more

[skullguy]

There is quite a lot in the responses.

1. Sent off email to our admin to investigate the issue, as it did occur after his hardening.

I'll wait to see what the next move might be, and it might just be a "move".

Keep you posted, Thanks for the info, suggestions, and ideas/resources. Took a look.

Thanks,
Skullguy