Hi,
In the cpanel server status it some times says swap is at 99-100%. What does this mean? What can I do about it?
Thanks
In the cpanel server status it some times says swap is at 99-100%. What does this mean? What can I do about it?
Thanks
It means all of your memory has been used up, and even the assigned hard drive space (swap) to use as virtual memory has been used up. I'd see what's causing the issue.
Run: ps axfu
And copy and paste the results.
Also post : ps -u nobody , to see is possible perl bots / etc have been started by the apache user.
You can also check top to see possible issues.
Run: ps axfu
And copy and paste the results.
Also post : ps -u nobody , to see is possible perl bots / etc have been started by the apache user.
You can also check top to see possible issues.
Thanks for the reply, the server is used as an uploading/file sharing site.
From ps axfu:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 2436 396 ? S 14:15 0:00 init [3]
root 2 0.0 0.0 0 0 ? S 14:15 0:00 [migration/0]
root 3 0.0 0.0 0 0 ? SN 14:15 0:00 [ksoftirqd/0]
root 4 0.0 0.0 0 0 ? S 14:15 0:00 [migration/1]
root 5 0.0 0.0 0 0 ? SN 14:15 0:00 [ksoftirqd/1]
root 6 0.0 0.0 0 0 ? S 14:15 0:00 [migration/2]
root 7 0.0 0.0 0 0 ? SN 14:15 0:00 [ksoftirqd/2]
root 8 0.0 0.0 0 0 ? S 14:15 0:00 [migration/3]
root 9 0.0 0.0 0 0 ? SN 14:15 0:00 [ksoftirqd/3]
root 10 0.0 0.0 0 0 ? S< 14:15 0:00 [events/0]
root 14 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [khelper]
root 15 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [kacpid]
root 44 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [kblockd/0]
root 45 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [kblockd/1]
root 46 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [kblockd/2]
root 47 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [kblockd/3]
root 60 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [aio/0]
root 61 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [aio/1]
root 62 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [aio/2]
root 63 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [aio/3]
root 9657 0.0 0.0 0 0 ? S 17:38 0:00 \_ [pdflush]
root 11 0.0 0.0 0 0 ? S< 14:15 0:00 [events/1]
root 213 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [ata/0]
root 214 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [ata/1]
root 215 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [ata/2]
root 216 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [ata/3]
root 9607 0.0 0.0 0 0 ? D 17:31 0:00 \_ [pdflush]
root 9653 0.0 0.0 0 0 ? S 17:37 0:00 \_ [pdflush]
root 12 0.0 0.0 0 0 ? S< 14:15 0:00 [events/2]
root 9450 0.0 0.0 0 0 ? S 17:29 0:00 \_ [pdflush]
From ps axfu:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 2436 396 ? S 14:15 0:00 init [3]
root 2 0.0 0.0 0 0 ? S 14:15 0:00 [migration/0]
root 3 0.0 0.0 0 0 ? SN 14:15 0:00 [ksoftirqd/0]
root 4 0.0 0.0 0 0 ? S 14:15 0:00 [migration/1]
root 5 0.0 0.0 0 0 ? SN 14:15 0:00 [ksoftirqd/1]
root 6 0.0 0.0 0 0 ? S 14:15 0:00 [migration/2]
root 7 0.0 0.0 0 0 ? SN 14:15 0:00 [ksoftirqd/2]
root 8 0.0 0.0 0 0 ? S 14:15 0:00 [migration/3]
root 9 0.0 0.0 0 0 ? SN 14:15 0:00 [ksoftirqd/3]
root 10 0.0 0.0 0 0 ? S< 14:15 0:00 [events/0]
root 14 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [khelper]
root 15 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [kacpid]
root 44 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [kblockd/0]
root 45 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [kblockd/1]
root 46 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [kblockd/2]
root 47 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [kblockd/3]
root 60 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [aio/0]
root 61 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [aio/1]
root 62 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [aio/2]
root 63 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [aio/3]
root 9657 0.0 0.0 0 0 ? S 17:38 0:00 \_ [pdflush]
root 11 0.0 0.0 0 0 ? S< 14:15 0:00 [events/1]
root 213 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [ata/0]
root 214 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [ata/1]
root 215 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [ata/2]
root 216 0.0 0.0 0 0 ? S< 14:15 0:00 \_ [ata/3]
root 9607 0.0 0.0 0 0 ? D 17:31 0:00 \_ [pdflush]
root 9653 0.0 0.0 0 0 ? S 17:37 0:00 \_ [pdflush]
root 12 0.0 0.0 0 0 ? S< 14:15 0:00 [events/2]
root 9450 0.0 0.0 0 0 ? S 17:29 0:00 \_ [pdflush]
continued:
root 13 0.0 0.0 0 0 ? S< 14:15 0:00 [events/3]
root 1536 0.0 0.0 0 0 ? S< 14:16 0:00 \_ [kauditd]
root 1612 0.0 0.0 0 0 ? S< 14:16 0:00 \_ [kmirrord]
root 1613 0.0 0.0 0 0 ? S< 14:16 0:00 \_ [kmir_mon]
root 48 0.0 0.0 0 0 ? S 14:15 0:00 [khubd]
root 59 0.7 0.0 0 0 ? D 14:15 1:35 [kswapd0]
root 136 0.0 0.0 0 0 ? S 14:15 0:00 [kseriod]
root 222 0.0 0.0 0 0 ? S 14:15 0:00 [scsi_eh_0]
root 230 0.0 0.0 0 0 ? S 14:15 0:00 [scsi_eh_1]
root 243 0.0 0.0 0 0 ? S 14:15 0:01 [kjournald]
root 1088 0.0 0.0 2276 276 ? S<s 14:15 0:00 udevd
root 1663 0.0 0.0 0 0 ? S 14:16 0:00 [kjournald]
root 1734 0.0 0.0 0 0 ? S< 14:16 0:06 [loop0]
root 2475 0.0 0.0 1760 508 ? Ss 14:16 0:00 syslogd -m 0
root 2479 0.0 0.0 1660 332 ? Ss 14:16 0:00 klogd -x
root 2489 0.0 0.0 1968 412 ? Ss 14:16 0:00 irqbalance
root 2498 0.0 0.0 1632 312 ? S 14:16 0:00 /usr/sbin/courier
root 2499 0.0 0.0 3272 368 ? S 14:16 0:00 \_ /usr/libexec/
root 2519 0.0 0.0 3272 376 ? S 14:16 0:00 \_ /usr/libe
root 2520 0.0 0.0 3272 380 ? S 14:16 0:00 \_ /usr/libe
root 2521 0.0 0.0 3272 376 ? S 14:16 0:00 \_ /usr/libe
root 2522 0.0 0.0 3272 376 ? S 14:16 0:00 \_ /usr/libe
root 2523 0.0 0.0 3272 376 ? S 14:16 0:00 \_ /usr/libe
root 2534 0.0 0.0 5128 520 ? Ss 14:16 0:00 rpc.idmapd
root 2588 0.0 0.0 2376 360 ? Ss 14:16 0:00 /usr/sbin/acpid
root 4015 0.0 0.0 4676 724 ? Ss 14:16 0:00 /usr/sbin/sshd
root 9655 0.0 0.1 7484 1808 ? Ss 17:38 0:00 \_ sshd: root@pt
root 9659 0.0 0.1 4352 1380 pts/0 Ss 17:38 0:00 \_ -bash
root 9706 0.0 0.0 3328 812 pts/0 R+ 17:38 0:00 \_ ps ax
root 4042 0.0 0.0 3088 500 ? Ss 14:16 0:00 xinetd -stayalive
ntp 4057 0.0 0.5 5360 5360 ? SLs 14:16 0:00 ntpd -u ntp:ntp -
root 4075 0.0 0.1 12696 1740 ? S 14:16 0:00 chkservd
root 9649 0.0 0.2 6660 2460 ? S 17:36 0:00 \_ /usr/bin/perl
root 9650 0.0 0.0 3528 544 ? S 17:36 0:00 \_ /usr/bin/
root 4086 0.0 0.0 2248 412 ? S 14:16 0:00 /usr/sbin/courier
root 4087 0.0 0.0 1696 432 ? S 14:16 0:00 \_ /usr/lib/cour
root 4094 0.0 0.0 1944 292 ? S 14:16 0:00 /usr/sbin/courier
root 4095 0.0 0.0 1604 356 ? S 14:16 0:00 \_ /usr/lib/cour
root 4101 0.0 0.0 1480 412 ? S 14:16 0:00 /usr/sbin/courier
root 4102 0.0 0.0 1820 432 ? S 14:16 0:00 \_ /usr/lib/cour
root 4108 0.0 0.0 2640 292 ? S 14:16 0:00 /usr/sbin/courier
root 4109 0.0 0.0 2020 356 ? S 14:16 0:00 \_ /usr/lib/cour
mailnull 4173 0.0 0.0 8940 956 ? Ss 14:16 0:00 /usr/sbin/exim -b
mailnull 4177 0.0 0.0 7972 800 ? Ss 14:16 0:00 /usr/sbin/exim -t
root 4183 0.0 0.1 3948 1052 ? S 14:16 0:00 antirelayd
root 4228 0.0 0.2 27368 2240 ? Ss 14:16 0:00 /usr/bin/spamd -d
nobody 4243 0.0 0.9 27500 9516 ? D 14:16 0:02 \_ spamd child
root 4244 0.0 0.1 27368 1628 ? S 14:16 0:00 \_ spamd child
root 4254 0.0 0.0 5016 668 ? Ss 14:16 0:00 crond
root 4444 0.0 0.1 12252 1868 ? S 14:16 0:00 cpsrvd - waiting
flyuploa 9652 0.0 0.4 12324 4140 ? Ds 17:37 0:00 \_ cpaneld - ser
flyuploa 9654 0.1 0.0 0 0 ? Z 17:37 0:00 | \_ [cpanel]
flyuploa 9683 0.1 0.3 12260 3688 ? Ss 17:38 0:00 \_ cpaneld - ser
flyuploa 9688 0.1 0.3 12260 3676 ? Ss 17:38 0:00 \_ cpaneld - ser
flyuploa 9689 0.0 0.3 12260 3676 ? Ss 17:38 0:00 \_ cpaneld - ser
root 4471 0.0 0.1 6496 1292 ? Ss 14:16 0:00 pure-ftpd (SERVER
root 4474 0.0 0.0 6808 484 ? S 14:16 0:00 /usr/sbin/pure-au
root 4492 0.0 0.1 7448 1564 ? S 14:16 0:00 cpbandwd
root 4493 0.0 0.1 11412 1808 ? SN 14:16 0:00 cpanellogd - slee
root 4504 0.0 0.2 19252 2720 ? Ss 14:16 0:00 /usr/local/apache
nobody 4585 0.0 0.4 48072 4232 ? D 14:16 0:03 \_ /usr/local/ap
nobody 4586 0.0 0.4 378920 5068 ? S 14:16 0:09 \_ /usr/local/ap
nobody 4587 0.0 0.6 63020 6512 ? S 14:16 0:04 \_ /usr/local/ap
nobody 4588 0.0 0.3 63020 3860 ? S 14:16 0:02 \_ /usr/local/ap
nobody 4589 0.0 4.8 117468 50104 ? S 14:16 0:00 \_ /usr/local/ap
nobody 5179 0.0 0.3 19384 3188 ? S 14:16 0:02 \_ /usr/local/ap
nobody 5240 0.0 1.7 86208 17860 ? S 14:16 0:04 \_ /usr/local/ap
nobody 5260 0.0 1.9 285592 20208 ? D 14:16 0:03 \_ /usr/local/ap
nobody 5261 0.0 0.2 43900 2912 ? S 14:16 0:02 \_ /usr/local/ap
nobody 5266 0.0 0.2 72132 3040 ? D 14:17 0:02 \_ /usr/local/ap
nobody 5271 0.0 2.3 246292 23968 ? S 14:17 0:02 \_ /usr/local/ap
nobody 5308 0.0 0.6 39144 6748 ? S 14:18 0:02 \_ /usr/local/ap
nobody 5585 0.0 0.3 58484 3944 ? S 14:25 0:02 \_ /usr/local/ap
nobody 5586 0.0 3.6 117468 37812 ? S 14:25 0:03 \_ /usr/local/ap
nobody 5587 0.1 1.5 512020 15820 ? S 14:26 0:12 \_ /usr/local/ap
nobody 5588 0.0 0.3 19388 3312 ? S 14:26 0:02 \_ /usr/local/ap
nobody 5589 0.0 0.5 63020 5288 ? S 14:26 0:00 \_ /usr/local/ap
nobody 5590 0.0 1.3 271104 14392 ? S 14:26 0:04 \_ /usr/local/ap
nobody 5591 0.0 1.3 413936 14344 ? S 14:26 0:10 \_ /usr/local/ap
nobody 5592 0.0 0.4 273744 4636 ? S 14:26 0:01 \_ /usr/local/ap
nobody 5593 0.0 1.5 63020 16076 ? S 14:26 0:01 \_ /usr/local/ap
nobody 5594 0.0 5.8 117468 60064 ? S 14:26 0:02 \_ /usr/local/ap
nobody 5595 0.0 0.8 273744 8936 ? S 14:26 0:01 \_ /usr/local/ap
nobody 5601 0.0 0.3 19388 3348 ? S 14:28 0:01 \_ /usr/local/ap
nobody 5602 0.0 2.4 110112 25540 ? S 14:28 0:03 \_ /usr/local/ap
nobody 5603 0.0 0.2 117476 2944 ? S 14:28 0:01 \_ /usr/local/ap
nobody 5604 0.0 4.2 271108 43456 ? D 14:28 0:03 \_ /usr/local/ap
nobody 5605 0.0 1.1 39144 11836 ? D 14:29 0:03 \_ /usr/local/ap
nobody 5606 0.0 1.2 271108 12792 ? D 14:29 0:02 \_ /usr/local/ap
nobody 5861 0.0 4.8 545644 50548 ? S 14:30 0:04 \_ /usr/local/ap
nobody 5862 0.0 0.2 63020 2900 ? S 14:30 0:02 \_ /usr/local/ap
nobody 5863 0.0 0.4 63020 4548 ? S 14:30 0:02 \_ /usr/local/ap
nobody 5864 0.0 1.8 117468 19600 ? S 14:32 0:01 \_ /usr/local/ap
nobody 5885 0.0 0.8 41772 8564 ? S 14:33 0:02 \_ /usr/local/ap
nobody 5886 0.0 3.4 326700 35784 ? S 14:34 0:04 \_ /usr/local/ap
nobody 5887 0.0 0.4 273744 4608 ? D 14:34 0:03 \_ /usr/local/ap
nobody 5901 0.0 7.8 112680 80892 ? S 14:37 0:02 \_ /usr/local/ap
nobody 5905 0.0 2.4 110108 25852 ? S 14:37 0:02 \_ /usr/local/ap
nobody 6096 0.0 1.1 43896 12188 ? S 14:45 0:01 \_ /usr/local/ap
nobody 6098 0.0 0.3 252668 3272 ? S 14:45 0:04 \_ /usr/local/ap
nobody 6101 0.0 0.4 69172 5056 ? S 14:45 0:01 \_ /usr/local/ap
nobody 6102 0.0 6.2 273744 64120 ? S 14:46 0:01 \_ /usr/local/ap
nobody 6108 0.0 0.4 22672 4920 ? S 14:47 0:03 \_ /usr/local/ap
root 13 0.0 0.0 0 0 ? S< 14:15 0:00 [events/3]
root 1536 0.0 0.0 0 0 ? S< 14:16 0:00 \_ [kauditd]
root 1612 0.0 0.0 0 0 ? S< 14:16 0:00 \_ [kmirrord]
root 1613 0.0 0.0 0 0 ? S< 14:16 0:00 \_ [kmir_mon]
root 48 0.0 0.0 0 0 ? S 14:15 0:00 [khubd]
root 59 0.7 0.0 0 0 ? D 14:15 1:35 [kswapd0]
root 136 0.0 0.0 0 0 ? S 14:15 0:00 [kseriod]
root 222 0.0 0.0 0 0 ? S 14:15 0:00 [scsi_eh_0]
root 230 0.0 0.0 0 0 ? S 14:15 0:00 [scsi_eh_1]
root 243 0.0 0.0 0 0 ? S 14:15 0:01 [kjournald]
root 1088 0.0 0.0 2276 276 ? S<s 14:15 0:00 udevd
root 1663 0.0 0.0 0 0 ? S 14:16 0:00 [kjournald]
root 1734 0.0 0.0 0 0 ? S< 14:16 0:06 [loop0]
root 2475 0.0 0.0 1760 508 ? Ss 14:16 0:00 syslogd -m 0
root 2479 0.0 0.0 1660 332 ? Ss 14:16 0:00 klogd -x
root 2489 0.0 0.0 1968 412 ? Ss 14:16 0:00 irqbalance
root 2498 0.0 0.0 1632 312 ? S 14:16 0:00 /usr/sbin/courier
root 2499 0.0 0.0 3272 368 ? S 14:16 0:00 \_ /usr/libexec/
root 2519 0.0 0.0 3272 376 ? S 14:16 0:00 \_ /usr/libe
root 2520 0.0 0.0 3272 380 ? S 14:16 0:00 \_ /usr/libe
root 2521 0.0 0.0 3272 376 ? S 14:16 0:00 \_ /usr/libe
root 2522 0.0 0.0 3272 376 ? S 14:16 0:00 \_ /usr/libe
root 2523 0.0 0.0 3272 376 ? S 14:16 0:00 \_ /usr/libe
root 2534 0.0 0.0 5128 520 ? Ss 14:16 0:00 rpc.idmapd
root 2588 0.0 0.0 2376 360 ? Ss 14:16 0:00 /usr/sbin/acpid
root 4015 0.0 0.0 4676 724 ? Ss 14:16 0:00 /usr/sbin/sshd
root 9655 0.0 0.1 7484 1808 ? Ss 17:38 0:00 \_ sshd: root@pt
root 9659 0.0 0.1 4352 1380 pts/0 Ss 17:38 0:00 \_ -bash
root 9706 0.0 0.0 3328 812 pts/0 R+ 17:38 0:00 \_ ps ax
root 4042 0.0 0.0 3088 500 ? Ss 14:16 0:00 xinetd -stayalive
ntp 4057 0.0 0.5 5360 5360 ? SLs 14:16 0:00 ntpd -u ntp:ntp -
root 4075 0.0 0.1 12696 1740 ? S 14:16 0:00 chkservd
root 9649 0.0 0.2 6660 2460 ? S 17:36 0:00 \_ /usr/bin/perl
root 9650 0.0 0.0 3528 544 ? S 17:36 0:00 \_ /usr/bin/
root 4086 0.0 0.0 2248 412 ? S 14:16 0:00 /usr/sbin/courier
root 4087 0.0 0.0 1696 432 ? S 14:16 0:00 \_ /usr/lib/cour
root 4094 0.0 0.0 1944 292 ? S 14:16 0:00 /usr/sbin/courier
root 4095 0.0 0.0 1604 356 ? S 14:16 0:00 \_ /usr/lib/cour
root 4101 0.0 0.0 1480 412 ? S 14:16 0:00 /usr/sbin/courier
root 4102 0.0 0.0 1820 432 ? S 14:16 0:00 \_ /usr/lib/cour
root 4108 0.0 0.0 2640 292 ? S 14:16 0:00 /usr/sbin/courier
root 4109 0.0 0.0 2020 356 ? S 14:16 0:00 \_ /usr/lib/cour
mailnull 4173 0.0 0.0 8940 956 ? Ss 14:16 0:00 /usr/sbin/exim -b
mailnull 4177 0.0 0.0 7972 800 ? Ss 14:16 0:00 /usr/sbin/exim -t
root 4183 0.0 0.1 3948 1052 ? S 14:16 0:00 antirelayd
root 4228 0.0 0.2 27368 2240 ? Ss 14:16 0:00 /usr/bin/spamd -d
nobody 4243 0.0 0.9 27500 9516 ? D 14:16 0:02 \_ spamd child
root 4244 0.0 0.1 27368 1628 ? S 14:16 0:00 \_ spamd child
root 4254 0.0 0.0 5016 668 ? Ss 14:16 0:00 crond
root 4444 0.0 0.1 12252 1868 ? S 14:16 0:00 cpsrvd - waiting
flyuploa 9652 0.0 0.4 12324 4140 ? Ds 17:37 0:00 \_ cpaneld - ser
flyuploa 9654 0.1 0.0 0 0 ? Z 17:37 0:00 | \_ [cpanel]
flyuploa 9683 0.1 0.3 12260 3688 ? Ss 17:38 0:00 \_ cpaneld - ser
flyuploa 9688 0.1 0.3 12260 3676 ? Ss 17:38 0:00 \_ cpaneld - ser
flyuploa 9689 0.0 0.3 12260 3676 ? Ss 17:38 0:00 \_ cpaneld - ser
root 4471 0.0 0.1 6496 1292 ? Ss 14:16 0:00 pure-ftpd (SERVER
root 4474 0.0 0.0 6808 484 ? S 14:16 0:00 /usr/sbin/pure-au
root 4492 0.0 0.1 7448 1564 ? S 14:16 0:00 cpbandwd
root 4493 0.0 0.1 11412 1808 ? SN 14:16 0:00 cpanellogd - slee
root 4504 0.0 0.2 19252 2720 ? Ss 14:16 0:00 /usr/local/apache
nobody 4585 0.0 0.4 48072 4232 ? D 14:16 0:03 \_ /usr/local/ap
nobody 4586 0.0 0.4 378920 5068 ? S 14:16 0:09 \_ /usr/local/ap
nobody 4587 0.0 0.6 63020 6512 ? S 14:16 0:04 \_ /usr/local/ap
nobody 4588 0.0 0.3 63020 3860 ? S 14:16 0:02 \_ /usr/local/ap
nobody 4589 0.0 4.8 117468 50104 ? S 14:16 0:00 \_ /usr/local/ap
nobody 5179 0.0 0.3 19384 3188 ? S 14:16 0:02 \_ /usr/local/ap
nobody 5240 0.0 1.7 86208 17860 ? S 14:16 0:04 \_ /usr/local/ap
nobody 5260 0.0 1.9 285592 20208 ? D 14:16 0:03 \_ /usr/local/ap
nobody 5261 0.0 0.2 43900 2912 ? S 14:16 0:02 \_ /usr/local/ap
nobody 5266 0.0 0.2 72132 3040 ? D 14:17 0:02 \_ /usr/local/ap
nobody 5271 0.0 2.3 246292 23968 ? S 14:17 0:02 \_ /usr/local/ap
nobody 5308 0.0 0.6 39144 6748 ? S 14:18 0:02 \_ /usr/local/ap
nobody 5585 0.0 0.3 58484 3944 ? S 14:25 0:02 \_ /usr/local/ap
nobody 5586 0.0 3.6 117468 37812 ? S 14:25 0:03 \_ /usr/local/ap
nobody 5587 0.1 1.5 512020 15820 ? S 14:26 0:12 \_ /usr/local/ap
nobody 5588 0.0 0.3 19388 3312 ? S 14:26 0:02 \_ /usr/local/ap
nobody 5589 0.0 0.5 63020 5288 ? S 14:26 0:00 \_ /usr/local/ap
nobody 5590 0.0 1.3 271104 14392 ? S 14:26 0:04 \_ /usr/local/ap
nobody 5591 0.0 1.3 413936 14344 ? S 14:26 0:10 \_ /usr/local/ap
nobody 5592 0.0 0.4 273744 4636 ? S 14:26 0:01 \_ /usr/local/ap
nobody 5593 0.0 1.5 63020 16076 ? S 14:26 0:01 \_ /usr/local/ap
nobody 5594 0.0 5.8 117468 60064 ? S 14:26 0:02 \_ /usr/local/ap
nobody 5595 0.0 0.8 273744 8936 ? S 14:26 0:01 \_ /usr/local/ap
nobody 5601 0.0 0.3 19388 3348 ? S 14:28 0:01 \_ /usr/local/ap
nobody 5602 0.0 2.4 110112 25540 ? S 14:28 0:03 \_ /usr/local/ap
nobody 5603 0.0 0.2 117476 2944 ? S 14:28 0:01 \_ /usr/local/ap
nobody 5604 0.0 4.2 271108 43456 ? D 14:28 0:03 \_ /usr/local/ap
nobody 5605 0.0 1.1 39144 11836 ? D 14:29 0:03 \_ /usr/local/ap
nobody 5606 0.0 1.2 271108 12792 ? D 14:29 0:02 \_ /usr/local/ap
nobody 5861 0.0 4.8 545644 50548 ? S 14:30 0:04 \_ /usr/local/ap
nobody 5862 0.0 0.2 63020 2900 ? S 14:30 0:02 \_ /usr/local/ap
nobody 5863 0.0 0.4 63020 4548 ? S 14:30 0:02 \_ /usr/local/ap
nobody 5864 0.0 1.8 117468 19600 ? S 14:32 0:01 \_ /usr/local/ap
nobody 5885 0.0 0.8 41772 8564 ? S 14:33 0:02 \_ /usr/local/ap
nobody 5886 0.0 3.4 326700 35784 ? S 14:34 0:04 \_ /usr/local/ap
nobody 5887 0.0 0.4 273744 4608 ? D 14:34 0:03 \_ /usr/local/ap
nobody 5901 0.0 7.8 112680 80892 ? S 14:37 0:02 \_ /usr/local/ap
nobody 5905 0.0 2.4 110108 25852 ? S 14:37 0:02 \_ /usr/local/ap
nobody 6096 0.0 1.1 43896 12188 ? S 14:45 0:01 \_ /usr/local/ap
nobody 6098 0.0 0.3 252668 3272 ? S 14:45 0:04 \_ /usr/local/ap
nobody 6101 0.0 0.4 69172 5056 ? S 14:45 0:01 \_ /usr/local/ap
nobody 6102 0.0 6.2 273744 64120 ? S 14:46 0:01 \_ /usr/local/ap
nobody 6108 0.0 0.4 22672 4920 ? S 14:47 0:03 \_ /usr/local/ap
continued:
nobody 6114 0.0 0.7 273744 7460 ? S 14:49 0:02 \_ /usr/local/ap
nobody 6686 0.0 0.3 63020 3660 ? S 15:14 0:00 \_ /usr/local/ap
nobody 6930 0.0 1.8 273740 18888 ? S 15:26 0:01 \_ /usr/local/ap
nobody 6933 0.0 0.3 63016 3112 ? S 15:26 0:00 \_ /usr/local/ap
nobody 6936 0.0 2.1 110112 22548 ? D 15:26 0:01 \_ /usr/local/ap
nobody 6946 0.0 0.8 273740 8544 ? S 15:28 0:01 \_ /usr/local/ap
nobody 7103 0.0 0.7 273744 8108 ? S 15:32 0:00 \_ /usr/local/ap
nobody 7967 0.0 1.3 117464 13968 ? S 16:16 0:00 \_ /usr/local/ap
nobody 7969 0.0 2.1 273744 21804 ? S 16:16 0:00 \_ /usr/local/ap
nobody 8385 0.1 2.0 287332 21600 ? D 16:39 0:04 \_ /usr/local/ap
nobody 8769 0.4 17.8 298708 184076 ? D 16:55 0:12 \_ /usr/local/ap
nobody 8775 0.0 2.4 110108 25760 ? S 16:55 0:00 \_ /usr/local/ap
nobody 8786 0.0 0.2 273740 2916 ? S 16:56 0:00 \_ /usr/local/ap
nobody 8789 0.0 0.2 117464 3048 ? S 16:56 0:00 \_ /usr/local/ap
nobody 8976 0.0 0.3 63016 3844 ? S 17:03 0:00 \_ /usr/local/ap
nobody 8979 0.0 0.3 63016 3920 ? S 17:05 0:00 \_ /usr/local/ap
nobody 9187 0.0 1.1 117464 12012 ? S 17:11 0:00 \_ /usr/local/ap
nobody 9196 0.1 0.3 19384 3240 ? S 17:14 0:02 \_ /usr/local/ap
nobody 9214 0.0 2.8 155008 29692 ? D 17:15 0:00 \_ /usr/local/ap
nobody 9236 0.0 0.2 117468 2980 ? S 17:17 0:00 \_ /usr/local/ap
nobody 9239 0.0 0.3 19388 3208 ? S 17:17 0:00 \_ /usr/local/apnobody 9240 0.0 0.2 117464 2912 ? S 17:18 0:00 \_ /usr/local/ap
nobody 9241 0.0 0.2 43896 2912 ? S 17:18 0:00 \_ /usr/local/ap
nobody 9242 0.0 2.4 110108 25652 ? S 17:19 0:00 \_ /usr/local/ap
nobody 9397 0.0 1.8 285464 18868 ? S 17:21 0:00 \_ /usr/local/ap
nobody 9398 0.0 1.3 285464 14344 ? S 17:23 0:00 \_ /usr/local/ap
nobody 9451 0.0 1.4 50668 15408 ? S 17:30 0:00 \_ /usr/local/ap
nobody 9608 0.0 1.6 117464 17352 ? S 17:32 0:00 \_ /usr/local/ap
nobody 9624 0.0 0.4 63016 4592 ? D 17:35 0:00 \_ /usr/local/ap
nobody 4513 0.0 0.0 5512 784 ? S 14:16 0:00 entropychat
nobody 4517 0.0 0.0 1672 312 ? S 14:16 0:00 /usr/local/cpanel
cpanel 4561 0.0 0.1 4924 1172 ? Ss 14:16 0:00 /usr/bin/stunnel-
mailman 4595 0.0 0.1 10960 1388 ? Ss 14:16 0:00 /usr/local/bin/py
mailman 4613 0.0 0.1 10928 1648 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4614 0.0 0.1 9196 1672 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4615 0.0 0.1 10736 1704 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4616 0.0 0.1 10372 1672 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4617 0.0 0.1 9360 1708 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4618 0.0 0.1 10032 1672 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4619 0.0 0.1 10788 1720 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4620 0.0 0.1 10320 1520 ? S 14:16 0:00 \_ /usr/local/bi
dbus 4604 0.0 0.0 2952 548 ? Ss 14:16 0:00 dbus-daemon-1 --s
root 4621 0.0 0.1 7344 1544 ? Ss 14:16 0:00 hald
root 4761 0.0 0.0 5556 584 ? S 14:16 0:00 /bin/sh /usr/bin/
mysql 4786 0.0 0.1 108852 1888 ? Sl 14:16 0:00 \_ /usr/sbin/mys
root 4801 0.0 0.0 2264 340 tty1 Ss+ 14:16 0:00 /sbin/mingetty tt
root 4802 0.0 0.0 1840 340 tty2 Ss+ 14:16 0:00 /sbin/mingetty tt
root 4803 0.0 0.0 3440 340 tty3 Ss+ 14:16 0:00 /sbin/mingetty tt
root 4804 0.0 0.0 2632 340 tty4 Ss+ 14:16 0:00 /sbin/mingetty tt
root 4805 0.0 0.0 1456 340 tty5 Ss+ 14:16 0:00 /sbin/mingetty tt
root 4806 0.0 0.0 2636 340 tty6 Ss+ 14:16 0:00 /sbin/mingetty tt
named 5167 0.0 0.1 68584 1184 ? Ssl 14:16 0:00 /usr/sbin/named -
mailnull 5571 0.0 0.0 10932 972 ? S 14:25 0:00 eximstats
from ps -u nobody:
root@server2 [~]# ps -u nobody
PID TTY TIME CMD
4243 ? 00:00:02 spamd
4513 ? 00:00:00 entropychat
4517 ? 00:00:00 melange
4585 ? 00:00:03 httpd
4586 ? 00:00:09 httpd
4587 ? 00:00:04 httpd
4588 ? 00:00:02 httpd
4589 ? 00:00:00 httpd
5179 ? 00:00:02 httpd
5240 ? 00:00:04 httpd
5260 ? 00:00:03 httpd
5261 ? 00:00:02 httpd
5266 ? 00:00:02 httpd
5271 ? 00:00:02 httpd
5308 ? 00:00:02 httpd
5585 ? 00:00:02 httpd
5586 ? 00:00:03 httpd
5587 ? 00:00:12 httpd
5588 ? 00:00:02 httpd
5589 ? 00:00:00 httpd
5590 ? 00:00:04 httpd
5591 ? 00:00:10 httpd
5592 ? 00:00:01 httpd
5593 ? 00:00:01 httpd
5594 ? 00:00:02 httpd
5595 ? 00:00:01 httpd
5601 ? 00:00:01 httpd
5602 ? 00:00:03 httpd
5603 ? 00:00:01 httpd
5604 ? 00:00:03 httpd
5605 ? 00:00:03 httpd
5606 ? 00:00:02 httpd
5861 ? 00:00:04 httpd
5862 ? 00:00:02 httpd
5863 ? 00:00:02 httpd
5864 ? 00:00:01 httpd
5885 ? 00:00:02 httpd
5886 ? 00:00:04 httpd
5887 ? 00:00:03 httpd
5901 ? 00:00:03 httpd
5905 ? 00:00:02 httpd
6096 ? 00:00:01 httpd
6098 ? 00:00:04 httpd
6101 ? 00:00:01 httpd
6102 ? 00:00:01 httpd
6108 ? 00:00:03 httpd
6114 ? 00:00:02 httpd
6686 ? 00:00:00 httpd
6930 ? 00:00:01 httpd
6933 ? 00:00:00 httpd
6936 ? 00:00:01 httpd
6946 ? 00:00:01 httpd
7103 ? 00:00:00 httpd
7967 ? 00:00:00 httpd
7969 ? 00:00:00 httpd
8385 ? 00:00:04 httpd
8769 ? 00:00:12 httpd
8775 ? 00:00:00 httpd
8786 ? 00:00:00 httpd
8789 ? 00:00:00 httpd
8976 ? 00:00:00 httpd
8979 ? 00:00:00 httpd
9187 ? 00:00:00 httpd
9196 ? 00:00:02 httpd
9214 ? 00:00:00 httpd
9236 ? 00:00:00 httpd
9240 ? 00:00:00 httpd
9241 ? 00:00:00 httpd
9242 ? 00:00:00 httpd
9397 ? 00:00:00 httpd
9398 ? 00:00:00 httpd
9451 ? 00:00:00 httpd
9608 ? 00:00:00 httpd
9624 ? 00:00:00 httpd
9858 ? 00:00:00 httpd
Thanks
nobody 6114 0.0 0.7 273744 7460 ? S 14:49 0:02 \_ /usr/local/ap
nobody 6686 0.0 0.3 63020 3660 ? S 15:14 0:00 \_ /usr/local/ap
nobody 6930 0.0 1.8 273740 18888 ? S 15:26 0:01 \_ /usr/local/ap
nobody 6933 0.0 0.3 63016 3112 ? S 15:26 0:00 \_ /usr/local/ap
nobody 6936 0.0 2.1 110112 22548 ? D 15:26 0:01 \_ /usr/local/ap
nobody 6946 0.0 0.8 273740 8544 ? S 15:28 0:01 \_ /usr/local/ap
nobody 7103 0.0 0.7 273744 8108 ? S 15:32 0:00 \_ /usr/local/ap
nobody 7967 0.0 1.3 117464 13968 ? S 16:16 0:00 \_ /usr/local/ap
nobody 7969 0.0 2.1 273744 21804 ? S 16:16 0:00 \_ /usr/local/ap
nobody 8385 0.1 2.0 287332 21600 ? D 16:39 0:04 \_ /usr/local/ap
nobody 8769 0.4 17.8 298708 184076 ? D 16:55 0:12 \_ /usr/local/ap
nobody 8775 0.0 2.4 110108 25760 ? S 16:55 0:00 \_ /usr/local/ap
nobody 8786 0.0 0.2 273740 2916 ? S 16:56 0:00 \_ /usr/local/ap
nobody 8789 0.0 0.2 117464 3048 ? S 16:56 0:00 \_ /usr/local/ap
nobody 8976 0.0 0.3 63016 3844 ? S 17:03 0:00 \_ /usr/local/ap
nobody 8979 0.0 0.3 63016 3920 ? S 17:05 0:00 \_ /usr/local/ap
nobody 9187 0.0 1.1 117464 12012 ? S 17:11 0:00 \_ /usr/local/ap
nobody 9196 0.1 0.3 19384 3240 ? S 17:14 0:02 \_ /usr/local/ap
nobody 9214 0.0 2.8 155008 29692 ? D 17:15 0:00 \_ /usr/local/ap
nobody 9236 0.0 0.2 117468 2980 ? S 17:17 0:00 \_ /usr/local/ap
nobody 9239 0.0 0.3 19388 3208 ? S 17:17 0:00 \_ /usr/local/apnobody 9240 0.0 0.2 117464 2912 ? S 17:18 0:00 \_ /usr/local/ap
nobody 9241 0.0 0.2 43896 2912 ? S 17:18 0:00 \_ /usr/local/ap
nobody 9242 0.0 2.4 110108 25652 ? S 17:19 0:00 \_ /usr/local/ap
nobody 9397 0.0 1.8 285464 18868 ? S 17:21 0:00 \_ /usr/local/ap
nobody 9398 0.0 1.3 285464 14344 ? S 17:23 0:00 \_ /usr/local/ap
nobody 9451 0.0 1.4 50668 15408 ? S 17:30 0:00 \_ /usr/local/ap
nobody 9608 0.0 1.6 117464 17352 ? S 17:32 0:00 \_ /usr/local/ap
nobody 9624 0.0 0.4 63016 4592 ? D 17:35 0:00 \_ /usr/local/ap
nobody 4513 0.0 0.0 5512 784 ? S 14:16 0:00 entropychat
nobody 4517 0.0 0.0 1672 312 ? S 14:16 0:00 /usr/local/cpanel
cpanel 4561 0.0 0.1 4924 1172 ? Ss 14:16 0:00 /usr/bin/stunnel-
mailman 4595 0.0 0.1 10960 1388 ? Ss 14:16 0:00 /usr/local/bin/py
mailman 4613 0.0 0.1 10928 1648 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4614 0.0 0.1 9196 1672 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4615 0.0 0.1 10736 1704 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4616 0.0 0.1 10372 1672 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4617 0.0 0.1 9360 1708 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4618 0.0 0.1 10032 1672 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4619 0.0 0.1 10788 1720 ? S 14:16 0:00 \_ /usr/local/bi
mailman 4620 0.0 0.1 10320 1520 ? S 14:16 0:00 \_ /usr/local/bi
dbus 4604 0.0 0.0 2952 548 ? Ss 14:16 0:00 dbus-daemon-1 --s
root 4621 0.0 0.1 7344 1544 ? Ss 14:16 0:00 hald
root 4761 0.0 0.0 5556 584 ? S 14:16 0:00 /bin/sh /usr/bin/
mysql 4786 0.0 0.1 108852 1888 ? Sl 14:16 0:00 \_ /usr/sbin/mys
root 4801 0.0 0.0 2264 340 tty1 Ss+ 14:16 0:00 /sbin/mingetty tt
root 4802 0.0 0.0 1840 340 tty2 Ss+ 14:16 0:00 /sbin/mingetty tt
root 4803 0.0 0.0 3440 340 tty3 Ss+ 14:16 0:00 /sbin/mingetty tt
root 4804 0.0 0.0 2632 340 tty4 Ss+ 14:16 0:00 /sbin/mingetty tt
root 4805 0.0 0.0 1456 340 tty5 Ss+ 14:16 0:00 /sbin/mingetty tt
root 4806 0.0 0.0 2636 340 tty6 Ss+ 14:16 0:00 /sbin/mingetty tt
named 5167 0.0 0.1 68584 1184 ? Ssl 14:16 0:00 /usr/sbin/named -
mailnull 5571 0.0 0.0 10932 972 ? S 14:25 0:00 eximstats
from ps -u nobody:
root@server2 [~]# ps -u nobody
PID TTY TIME CMD
4243 ? 00:00:02 spamd
4513 ? 00:00:00 entropychat
4517 ? 00:00:00 melange
4585 ? 00:00:03 httpd
4586 ? 00:00:09 httpd
4587 ? 00:00:04 httpd
4588 ? 00:00:02 httpd
4589 ? 00:00:00 httpd
5179 ? 00:00:02 httpd
5240 ? 00:00:04 httpd
5260 ? 00:00:03 httpd
5261 ? 00:00:02 httpd
5266 ? 00:00:02 httpd
5271 ? 00:00:02 httpd
5308 ? 00:00:02 httpd
5585 ? 00:00:02 httpd
5586 ? 00:00:03 httpd
5587 ? 00:00:12 httpd
5588 ? 00:00:02 httpd
5589 ? 00:00:00 httpd
5590 ? 00:00:04 httpd
5591 ? 00:00:10 httpd
5592 ? 00:00:01 httpd
5593 ? 00:00:01 httpd
5594 ? 00:00:02 httpd
5595 ? 00:00:01 httpd
5601 ? 00:00:01 httpd
5602 ? 00:00:03 httpd
5603 ? 00:00:01 httpd
5604 ? 00:00:03 httpd
5605 ? 00:00:03 httpd
5606 ? 00:00:02 httpd
5861 ? 00:00:04 httpd
5862 ? 00:00:02 httpd
5863 ? 00:00:02 httpd
5864 ? 00:00:01 httpd
5885 ? 00:00:02 httpd
5886 ? 00:00:04 httpd
5887 ? 00:00:03 httpd
5901 ? 00:00:03 httpd
5905 ? 00:00:02 httpd
6096 ? 00:00:01 httpd
6098 ? 00:00:04 httpd
6101 ? 00:00:01 httpd
6102 ? 00:00:01 httpd
6108 ? 00:00:03 httpd
6114 ? 00:00:02 httpd
6686 ? 00:00:00 httpd
6930 ? 00:00:01 httpd
6933 ? 00:00:00 httpd
6936 ? 00:00:01 httpd
6946 ? 00:00:01 httpd
7103 ? 00:00:00 httpd
7967 ? 00:00:00 httpd
7969 ? 00:00:00 httpd
8385 ? 00:00:04 httpd
8769 ? 00:00:12 httpd
8775 ? 00:00:00 httpd
8786 ? 00:00:00 httpd
8789 ? 00:00:00 httpd
8976 ? 00:00:00 httpd
8979 ? 00:00:00 httpd
9187 ? 00:00:00 httpd
9196 ? 00:00:02 httpd
9214 ? 00:00:00 httpd
9236 ? 00:00:00 httpd
9240 ? 00:00:00 httpd
9241 ? 00:00:00 httpd
9242 ? 00:00:00 httpd
9397 ? 00:00:00 httpd
9398 ? 00:00:00 httpd
9451 ? 00:00:00 httpd
9608 ? 00:00:00 httpd
9624 ? 00:00:00 httpd
9858 ? 00:00:00 httpd
Thanks
Alot of Apache processes, either a very busy site, or someone's abusing it and overloading your server on purpose.
Run
httpd stop;killall -9 httpd;httpd startssl
That should restart and clear up apache processes. Just a band aid solution for now.
Let me know if it starts to overload again, and Ill post directions on seeing if you have a possible DoS, or if not, we can tweak your script and or possibly Apache.
Run
httpd stop;killall -9 httpd;httpd startssl
That should restart and clear up apache processes. Just a band aid solution for now.
Let me know if it starts to overload again, and Ill post directions on seeing if you have a possible DoS, or if not, we can tweak your script and or possibly Apache.
IF you are frequently facing this issue then optimize your apache setting :
http://forums.linuxwebadmin.info/index.php/topic,37.0.html
Thanks,
http://forums.linuxwebadmin.info/index.php/topic,37.0.html
Thanks,
