High 5 minute load average alert

[Sathesh]

I've got a 2GB RAM VPS and I've been getting mails with 'lfd on High 5 minute load average alert' from the server like every hour or so (not exactly 1 hour though). The overall traffic seems to be low and in fact it has dropped in the last few days. I've attached the latest ps.txt file. Can anyone please help? I see a lot of 'nobody' and '501' user in the attached file. Is that a problem? Thanks in advance.

 

[Infopro]

Note the CPU usage for account: thinaboomi

You might want to take a closer look at that account.

 

[Sathesh]

Thanks Infopro. That's the hosting account. What or where should I look and what should I do?

 

[Infopro]

Is the site software (wordpress for example) and all plugins and themes for it fully up to date?

Assuming you have root access to the server, do you have CSF installed?

 

[Sathesh]

Yes, it's powered by Drupal and CSF is installed on it. I haven't updated the modules / plugins in a while since it might break something. It usually breaks something and that's why I'm scared to update when things just work fine. And the database is just huge that it can't restored quick enough if something goes wrong. This message popped up just recently during this week and the website has been doing fine for the last 2+ years. How can I pinpoint the issue?

 

[Infopro]

I think you just did. Out of date scripts get attacked because they're out of date and not secure.

I haven't updated the modules / plugins in a while since it might break something.

You should visit the drupal support site and find someone to help you update properly.

Drupal has had 6 updates to the core in the past month alone.
drupal.org/node/3060/release

 

[Sathesh]

Thanks for that. It just looks like the 'Print, PDF, Email' module had been receiving heavy email (spam) requests (didn't had Captcha in the form). After disabling that module, server seems to be running smoothly so far. I haven't received the 'High 5 minute load average alert' in almost 18 hours. I'll try updating that module and try to re-enable it. Thanks for your help.

 

[Infopro]

Excellent. Good luck with this.