| Posted by kshazad86, 05-25-2012, 07:19 AM | | I'm running a cPanel based server, and currently getting a very high number of apache threads opened all at the same time, which is causing the server to go down.
How can I find out which process/user is causing this?
Note: The command /usr/sbin/lsof -n -P -i TCP:80 reveals hundreds of different IP addresses, could this be a form of DDOS attack?
|
| Posted by Srv24x7, 05-25-2012, 07:41 AM | | Run top command and see what user is causing load, if you so nobody user then its surely some sort of perl script being executed which is causing multiple apache threads.
Check netstat command to see if you are getting any SYN floods.
|
| Posted by kshazad86, 05-25-2012, 07:42 AM | | Yea, checked all the total connections and SYN connections, nothing unusual just a couple of hundred connections, which is pretty standard.
|
| Posted by Srv24x7, 05-25-2012, 08:30 AM | | Then why is the server is going down ?
|
| Posted by kshazad86, 05-25-2012, 09:11 AM | | Managed to find 2 perl scripts hsoted on the server that were executed before server load wen through the roof and before the apache threads were ridiculously high, any ideas what they are doing?
|
| Posted by Srv24x7, 05-25-2012, 09:20 AM | | Some sort of streaming scripts or some kind of BOTS. under which user you found these perl scipts ?
|
| Posted by kshazad86, 05-25-2012, 09:21 AM | | User hosted a website under the server, I've suspended the account, and there are no issues, so it could be likely that the problem was caused by the user.
Also, CSF did send the following error just before the load went through the roof:
|
|
 Add to Favourites
 Print this Article
|
