lambov

Member
Oct 9, 2016
20
0
1
Earth
cPanel Access Level
Root Administrator
my average server load is 3 (my cpu core/thread is 4/8) but today my server load very high and load average within 10 and running command from ssh very slow too
based on htop process there was many nobody process /usr/sbin/httpd that using cpu more than 100%

i don't know why /usr/sbin/httpd cpu usage very high suddenly and because the process as nobody i can not find user that causing high load, and based on my cloudlinux lve stats i didn't find any user that using high load and also why cloudlinux lve can not handle the high load,, i tried to suspend some accounts that have average daily cpu usage high but it didn't much help

i contacted my datacenter tech if my server under DDOS attack but they told me that my server was not under attack,

now my server back normal after high load within 6 hours, but i don't know what was happening on my server, i'm using EA4 with mod_lsapi profile i have checked on apache error log but it looks normal to me

help me how to find process/user that caused my server high load on /usr/sbin/httpd as nobody
what apache profile should i use so /usr/sbin/httpd is not run as nobody but as user?
 

mariusfv

Active Member
Mar 24, 2013
35
7
133
Romania
cPanel Access Level
Root Administrator
Access your server as root

1. Use command:

Code:
top
then press (Shift+P) to sort processes as per CPU utilization and find top consumers.

*press q to exit top.

other useful commands of top(sort by memory, etc):

See Linux TOP commands

2. Use tail command to see latest errors in apache, cpanel, mod security, php-fpm, exim, or any package you have installed.
Log investigation of few of them:

Code:
tail -f /usr/local/apache/logs/access_log
tail -f /usr/local/apache/logs/error_log
tail -f /usr/local/cpanel/logs/access_log
tail -f /usr/local/apache/logs/modsec_audit.log
tail -f /etc/apache2/logs/modsec_audit.log
tail -f /var/log/exim_mainlog
*press Ctrl+C stop to retrieve the log

For cpanel:
cd /usr/local/cpanel/logs

ls -la

tail -f /usr/local/cpanel/logs/access_log

For specific username:

tail -f /home/UsernameHere/public_html/error_log
 
Last edited: