need help my vps server load high with apache

[bugton]

my server run on 4cores CPU / 10G RAM
but it's load very high when start apache

top - 13:32:13 up 54 min,  3 users,  load average: 100.28, 110.31, 100.70
Tasks: 339 total,  64 running, 262 sleeping,   0 stopped,  13 zombie
Cpu(s): 63.0%us, 26.7%sy,  0.0%ni,  0.0%id,  0.0%wa,  0.3%hi,  9.9%si,  0.0%st
Mem:  10129772k total,  2476084k used,  7653688k free,   128888k buffers
Swap:  5136376k total,        0k used,  5136376k free,  1343624k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
 1225 named     20   0  383m  21m 2620 S 15.6  0.2   2:43.00 named
 2279 mysql     20   0 2002m  92m 5340 S  9.8  0.9   8:23.63 mysqld
14676 root      20   0 35392 5532 1308 R  5.9  0.1   0:00.72 cPhulkd - proce
14678 root      20   0 35128 5176 1304 R  5.7  0.1   0:00.69 cPhulkd - proce
14681 root      20   0 34996 5092 1304 R  5.3  0.1   0:00.64 cPhulkd - proce
14683 root      20   0 34996 5124 1304 R  5.1  0.1   0:00.62 cPhulkd - proce
13676 root      20   0 57696  13m 1844 R  4.5  0.1   0:10.31 /usr/local/cpan
14597 root      20   0     0    0    0 R  4.4  0.0   0:01.79 cPhulkd - proce
13730 root      20   0  150m  12m  916 R  4.4  0.1   0:09.74 lfd - (child) p
14641 bkkthon   20   0  183m 9680 5632 R  4.4  0.1   0:01.22 php
14653 bkkthon   20   0  114m 5920 4024 R  4.4  0.1   0:00.97 php
13592 maxfitba  20   0  208m  26m 6520 R  4.3  0.3   0:11.19 php
14668 bkkthon   20   0  114m 5840 3980 R  4.3  0.1   0:00.84 php
13549 maxfitba  20   0  209m  28m 6524 R  4.2  0.3   0:11.64 php
14116 phathong  20   0  197m  16m 6176 R  4.2  0.2   0:06.39 php
14634 bkkthon   20   0  183m 9668 5628 R  4.2  0.1   0:01.27 php
14646 root      20   0 15164 1296  820 R  4.2  0.0   0:01.07 top
14658 root      20   0 35788 5880 1336 R  4.2  0.1   0:00.92 cPhulkd - proce
13511 root      20   0 67360  15m 1996 R  4.1  0.2   0:11.85 _build_translat
14151 root      20   0 52056  10m 1832 R  4.1  0.1   0:06.17 /usr/local/cpan
14515 bkkthon   20   0  181m 9480 6176 R  4.1  0.1   0:02.67 php
14577 bkkthon   20   0  184m  10m 5648 R  4.1  0.1   0:01.98 php
14602 bkkthon   20   0  183m 9692 5552 R  4.1  0.1   0:01.72 php
14605 root      20   0 71484 7440 2396 R  4.1  0.1   0:01.67 cPhulkd - proce
14614 bkkthon   20   0  183m 9692 5644 R  4.1  0.1   0:01.56 php
13499 root      20   0 55848  13m 1844 R  4.0  0.1   0:11.44 _build_translat
14338 root      20   0 38908 7384 1716 R  4.0  0.1   0:04.50 /usr/local/cpan
14477 maxfitba  20   0  196m  14m 6324 R  4.0  0.1   0:03.16 php
14608 root      20   0 71484 7400 2364 R  4.0  0.1   0:01.67 cPhulkd - proce
14612 root      20   0 69380 7048 2052 R  4.0  0.1   0:01.59 cPhulkd - proce
14633 bkkthon   20   0  183m 9744 5416 R  4.0  0.1   0:01.33 php
14669 windsor   20   0  114m 6456 4116 R  4.0  0.1   0:00.83 php
14694 bkkthon   20   0  104m 3856 2868 R  4.0  0.0   0:00.49 php
 2731 root      20   0  496m  96m 2316 R  3.9  1.0   3:00.63 clamd
11496 maxfitba  20   0  217m  37m 6960 R  3.9  0.4   0:30.34 php
14560 root      20   0 69380 7176 2160 R  3.9  0.1   0:02.03 cPhulkd - proce
14578 bkkthon   20   0  185m  11m 5720 R  3.9  0.1   0:01.95 php
14622 bkkthon   20   0  183m 9368 5572 R  3.9  0.1   0:01.43 php
13798 bkkthon   20   0     0    0    0 Z  3.9  0.0   0:08.82 php <defunct>
14529 bkkpanel  20   0  182m 9964 5752 R  3.9  0.1   0:02.40 php
14586 nawaplas  20   0  183m 9696 5368 R  3.9  0.1   0:01.76 php
14618 bkkthon   20   0     0    0    0 R  3.9  0.0   0:01.49 php
14637 windsor   20   0  105m 6408 4000 R  3.9  0.1   0:01.16 php
 1922 root      20   0  150m  13m 1488 R  3.8  0.1   2:07.17 lfd - scanning
14524 bkkthon   20   0  185m  11m 6000 R  3.8  0.1   0:02.57 php
14530 bkkthon   20   0  184m  10m 5608 R  3.8  0.1   0:02.40 php
14563 bkkthon   20   0  183m  10m 5896 R  3.8  0.1   0:02.08 php
14545 bkkthon   20   0  183m 9736 5568 R  3.7  0.1   0:02.26 php
  156 root      20   0 36096 1436 1140 S  3.6  0.0   3:53.22 plymouthd
10742 nobody    20   0  186m  10m 2268 R  3.6  0.1   0:13.62 httpd

what's wrong need help

 

[mageshm]

Hi bugton,

It's seem's too much of php file's are running on "bkkthon" account which is spike the load on server.

Try to suspend the account and monitor the server whether load spike or not.

I guess, it will help you to identify the root causes of issue.

For checking apache hits use below commands.

1) To print the number of apache hit’s/connection’s, use the below command
netstat -nt | grep :80 | wc -l

2) To calculate and count the number of connections each IP address connected to the server. Use the below command
netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1

 

[cPanelMichael]

Hello

The following thread might be helpful as well:

Troubleshooting High Loads On Linux Systems

Thank you.

 

[bugton]

UPDATE TODAY

top - 15:21:29 up 1 day,  7:37,  3 users,  load average: 39.77, 22.50, 17.42
Tasks: 263 total,  38 running, 224 sleeping,   0 stopped,   1 zombie
Cpu(s): 55.8%us, 32.9%sy,  0.0%ni,  0.0%id,  0.0%wa,  0.5%hi, 10.8%si,  0.0%st
Mem:  10129772k total,  9856112k used,   273660k free,   325768k buffers
Swap:  5136376k total,    44864k used,  5091512k free,  8269936k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
 1714 mysql     20   0 2204m 500m 5524 S 35.1  5.1 145:50.67 mysqld
18380 root      20   0  150m  12m  560 R 10.0  0.1   0:00.73 lfd - (child) c
18378 root      20   0 34864 3172 1304 R  9.3  0.0   0:00.68 cPhulkd - proce
18316 root      20   0 35788 4316 1336 R  9.2  0.0   0:01.74 cPhulkd - proce
18381 bkkthon   20   0  104m 4376 3024 R  9.2  0.0   0:00.67 php
17938 root      20   0 83428  26m 1960 R  9.1  0.3   0:15.59 csf.cgi
18087 root      20   0  150m  12m  900 R  9.1  0.1   0:06.94 lfd - (child) p
18339 root      20   0 35788 4268 1336 R  9.1  0.0   0:01.40 cPhulkd - proce
18259 bkkthon   20   0  184m 9824 6132 R  8.9  0.1   0:02.66 php
18354 bkkthon   20   0  184m 8564 5292 R  8.9  0.1   0:01.28 php
18369 bkkthon   20   0  105m 6632 4140 R  8.7  0.1   0:00.95 php
18340 root      20   0  102m  884  736 R  8.5  0.0   0:01.38 netstat
18384 bkkthon   20   0  102m 2284 1660 R  8.5  0.0   0:00.62 php
18249 chumsang  20   0  184m  10m 6208 R  8.4  0.1   0:02.76 php
18335 triplepl  20   0  185m 9808 5452 R  8.4  0.1   0:01.40 php
18348 windsor   20   0  194m 9640 5344 R  8.4  0.1   0:01.24 php
18201 bkkthon   20   0  184m 9960 6152 R  8.2  0.1   0:02.93 php
18304 lamphutr  20   0  195m  11m 5708 R  8.2  0.1   0:01.79 php
18306 lamphutr  20   0  193m 8668 5280 R  8.2  0.1   0:01.70 php
18313 windsor   20   0  185m 9.8m 5656 R  8.2  0.1   0:01.72 php
18312 bkkthon   20   0  193m 8736 5300 R  8.1  0.1   0:01.68 php
18318 thaidaiz  20   0  195m  10m 5712 R  8.1  0.1   0:01.56 php
18289 bkkthon   20   0  186m  10m 5664 R  8.0  0.1   0:02.15 php
18324 lamphutr  20   0  193m 8156 5080 R  7.8  0.1   0:01.47 php
18336 bkkthon   20   0  184m 8584 5300 R  7.8  0.1   0:01.33 php
18353 pcrmco    20   0  114m 6992 4368 R  7.7  0.1   0:01.16 php
18362 bkkthon   20   0  105m 6732 4196 R  7.1  0.1   0:00.98 php
16650 root      20   0  102m 6220 3108 R  7.0  0.1   0:54.79 sshd
18244 bkkthon   20   0     0    0    0 Z  7.0  0.0   0:02.36 php <defunct>
18396 root      20   0     0    0    0 R  5.5  0.0   0:00.40 lfd - (child) c
18236 bkkthon   20   0  196m  12m 6180 S  4.8  0.1   0:02.60 php
24342 root      20   0 15144 1392  944 R  4.8  0.0  17:58.39 top
15137 nobody    20   0  186m 5760 2416 R  4.7  0.1   0:03.93 httpd
18397 root      20   0 32188 2220 1116 R  4.3  0.0   0:00.31 cPhulkd - proce
18237 bkkthon   20   0  196m  12m 6148 S  3.8  0.1   0:02.57 php
16673 root      20   0 57964 2476 1656 S  3.7  0.0   0:37.11 sftp-server
18198 bkkthon   20   0  185m 9508 5596 R  3.6  0.1   0:01.36 php
28245 root      20   0  150m  13m 1488 S  3.3  0.1   2:14.20 lfd - sleeping
18127 nobody    20   0  186m 5408 2220 S  3.0  0.1   0:00.46 httpd
17972 nobody    20   0  186m 5360 2192 S  2.6  0.1   0:00.81 httpd
 1961 root      20   0 32056 2048 1684 S  2.5  0.0   1:12.02 cPhulkd - proce
 2066 root      20   0 76748 8696 1636 S  2.5  0.1  11:02.38 tailwatchd
  870 root      20   0     0    0    0 R  2.3  0.0  18:21.03 flush-253:0
18134 nobody    20   0  186m 5436 2240 R  2.1  0.1   0:00.41 httpd
18183 nobody    20   0  186m 5400 2212 S  2.1  0.1   0:01.56 httpd
17726 nobody    20   0  186m 5460 2248 S  1.9  0.1   0:01.46 httpd
  354 root      20   0     0    0    0 R  1.8  0.0  14:31.59 jbd2/dm-0-8
17477 nobody    20   0  186m 5668 2356 S  1.6  0.1   0:05.14 httpd
18133 nobody    20   0  186m 5472 2248 R  1.6  0.1   0:00.73 httpd
17167 nobody    20   0  186m 5720 2300 S  1.5  0.1   0:03.65 httpd

with command
netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1

[email protected] [/usr/local/ddos]# netstat -plan|grep :80|awk {'print $5'}|cut -d: -f
1|sort|uniq -c|sort -nk 1
      1
      1 0.0.0.0
      1 110.77.137.62
      1 110.77.208.22
      1 125.26.136.117
      1 125.26.178.99
      1 125.27.202.53
      1 1.46.161.85
      1 157.55.35.90
      1 157.55.36.35
      1 171.100.94.41
      1 171.7.198.177
      1 171.97.198.121
      1 171.98.142.224
      1 202.29.236.121
      1 202.46.49.199
      1 216.107.159.66
      1 27.150.208.218
      1 37.58.100.187
      1 49.230.157.170
      1 49.230.181.67
      1 49.48.145.128
      1 54.244.59.91
      1 61.90.107.237
      1 61.90.165.121
      1 66.249.77.155
      1 66.249.77.44
      2 1.0.146.124
      2 180.76.6.28
      2 182.53.46.158
      2 202.143.138.60
      2 27.55.208.23
      2 38.111.147.83
      2 58.11.183.245
      2 61.90.65.212
      3 110.77.219.145
      3 125.24.164.199
      3 1.46.130.201
      3 171.6.100.219
      3 203.150.206.90
      3 49.230.125.74
      3 49.230.98.17
      4 110.77.244.239
      4 1.46.165.245
      4 49.230.123.204
      6 223.207.250.133
     16 171.100.67.243
     17 49.230.99.245
     20 49.230.170.76