CPU load and apache

[NihaoHst]

For some reason, I recently have been getting random huge CPU load due to apache.
When it happends noone can connect to the server, if I'm lucky I can make a httpd stop via ssh after many minutes of waiting and hoping the connection wont be timout due to cpu being crazy. Otherwise I'm forced to ask my host for a hard reboot and the problem only happends hours or days later again...

Processor #1 Vendor: GenuineIntel
Processor #1 Name: Intel(R) Celeron(R) CPU 3.06GHz
Processor #1 speed: 3061.175 MHz
Processor #1 cache size: 256 KB

Memory: 506932k/516032k available (2150k kernel code, 8384k reserved, 719k data, 164k init, 0k highmem)

Linux 2.6.9-42.0.10.EL #1 Tue Feb 27 09:24:42 EST 2007 i686 i686 i386 GNU/Linux
Server Version: Apache/1.3.37 (Unix) PHP/5.2.1 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 FrontPage/5.0.2.2635.SR1.2 mod_ssl/2.8.28 OpenSSL/0.9.7a
Server Built: Aug 8 2006 22:09:17
Current Time: Tuesday, 15-May-2007 17:40:38 CEST
Restart Time: Tuesday, 15-May-2007 15:45:03 CEST
Parent Server Generation: 0
Server uptime: 1 hour 55 minutes 35 seconds
Total accesses: 20794 - Total Traffic: 65.9 MB
CPU Usage: u710.5 s63.58 cu.44 cs.5 - 11.2% CPU load
3 requests/sec - 9.7 kB/second - 3320 B/request
6 requests currently being processed, 8 idle servers

I don't understand whats causing it since my config is updated I have an average of 50 users on Vbulletin and a couple personal blogs/sites with low trafic.

I changed my httpd.conf and it helped lowering the number of times the cpu goes crazy but I got a new issue today and I dont the source of all these issues.

KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 4
MinSpareServers 5
MaxSpareServers 10
StartServers 5
MaxClients 150
MaxRequestsPerChild 1000

Full log is attached with about a 100 httpd sessions by user nobody.

If anyone has suggestions I'd be happy to listen.

Thanks in advance.

 

[useradmin]

apche eating memory.

hi,


there are all apache process stuck..
for example
date
Tue Jun 5 05:39:59 PDT 2007

nobody 1926 2.7 1.9 57772 41244 ? S 05:35 0:07 /usr/local/apache/bin/httpd -DSSL

mostly prcess show status = S
it means sleep mode..
as per id info

lrwxrwxrwx 1 root root 0 Jun 5 05:40 cwd -> //
-r-------- 1 root root 0 Jun 5 05:40 environ
lrwxrwxrwx 1 root root 0 Jun 5 05:40 exe -> /usr/local/apache/bin/httpd*

there are many such process.

free -m
total used free shared buffers cached
Mem: 2025 1952 72 0 149 953
-/+ buffers/cache: 849 1175
Swap: 8001 92 7908

we are not sure who is eating memory.. we tried to adjust httpd.conf and all everything but no use...

what to do in such case?

 

[eNetHosts]

Have you tried restarting cPanel and killing any background processes that you don't need, including using the WHM option to kill background processes that users shouldn't be running?

 

[Epademic]

Hi,

I'm experiencing the exact same problem http://forums.cpanel.net/showthread.php?t=63942

Been having this problem for the past few months, however very rarely can i not regain control either by restarting apache or its automatically killed by the process monitor.

From what I can tell its completely random. If i can be of any help troubleshooting let me know.

Cheers,

James

 

[vagsoftware]

Wassup!

Be carreful about iroffer, eggdrop and other shits like this. There are irc channel clients with sharing possibilities. That means that even if you have quota on user x, you can use quota on nobody . Permanent check quota on user nobody:

quota -v nobody

I discovered myself and bust them all. You can run this processed with nobody user and hide with xsh for example with other names and owners. The result, even if you write "ps aux" you are blind. Use detectors for nobody processing like nobody_check. Search on google. It is a powerful script that can monitor and destroy any kind of processes that are suspicios. It send alerts on email. Put it in cron. Use an email2sms service and you are a god!

Guys from cPanel! Solve this fucking problem with nobody user and virtual hosts (not using safe_mod in php, cause you can run perl also :D)!

Respekt.

PS: rkhunter also is a good scanning tool. Power to the people!