Excesive load due to apache

Braynid · 05-21-2007, 05:37 AM

Hello,

I have a VPS hosted at GoDaddy with CPU 2.80GHz, 512MB of RAM guaranteed and 2 GB bursted running a CentOS.

The thing is that sometimes, almost daily around 20.00 GMT+2 I experience a very high cpu load (as high as 30) that makes the hosted sites unreachable.

Using "ps -axu" I've noticed that apache makes all that load but I can't understand why. It's certainly not from the number of visitors that use the apache in the given moment.

Also in the error logs I've found the following:

Code:

[Mon May 14 13:39:30 2007] [error] [client 88.232.118.80] File does not exist: /var/www/html/button.php, referer: http://walpapers.evolink.ro/
[Mon May 14 13:39:30 2007] [error] [client 88.253.3.244] File does not exist: /var/www/html/button.php, referer: http://walpapers.evolink.ro/
[Mon May 14 13:39:30 2007] [error] [client 74.52.183.34] File does not exist: /var/www/html/button.php
[Mon May 14 13:39:30 2007] [error] [client 88.231.161.242] File does not exist: /var/www/html/button.php, referer: http://walpapers.evolink.ro/

Please notice there are up to four requests of the kind per second! Can this be the cause ?

Also I have 'tweaked' the apache configuration as follows:

Code:

KeepAliveTimeout 15

<IfModule prefork.c>
StartServers       1
MinSpareServers    1
MaxSpareServers    5
ServerLimit        50
MaxClients        50
MaxRequestsPerChild  4000

Can this be a problem also ?

Thanks.

edenCC · 05-21-2007, 11:06 PM

how about the output of "bin/httpd -l" and "netstat -st | grep estab"?

Braynid · 05-22-2007, 12:51 AM

Code:

[admin@ip-68-178-197-203 ~]$ netstat -st | grep estab
    3 connections established
    46 packets rejects in established connections because of timestamp

As about "bin/httpd -l" I really don't know what this is. "/etc/init.d/httpd" has no "-l" argument.

On the other hand I've checked my crontab and there is nothing there, so the problem it's not from crontab...

p_s_shah · 05-24-2007, 04:27 AM

Hello,

Enable Server status directive in httpd.conf
<Location /server-status>
SetHandler server-status
Order deny,allow
Deny from all
Allow from all
</Location>

Access current apache status through http://servername/server-status

Have a close look at status and try to find out if access of particular page increase CPU usage.

Update us with your findings.

Braynid · 05-25-2007, 05:34 AM

I did exactly what you said and it gives me:

Code:

14-18	-	0/0/243	. 	0.01	137	0	0.0	0.00	1.09 	81.181.70.17	domain.com	GET /button.php?u=noutatimp3&style=1 HTTP/1.0
15-18	-	0/0/385	. 	2.07	19	0	0.0	0.00	1.98 	89.165.176.203	samedomain.com	GET /button.php?u=chatro&style=1 HTTP/1.1
16-18	-	0/0/117	. 	0.03	2110	0	0.0	0.00	0.44 	85.204.123.70	samedomain.com	GET /button.php?u=olldmusic&style=banner3 HTTP/1.1
17-18	-	0/0/131	. 	0.02	2108	0	0.0	0.00	1.03 	89.41.1.150	samedomain.com	GET /button.php?u=livio&screen=1024x768&color=32&r=http%3A//www
18-18	-	0/0/63	. 	0.01	2120	0	0.0	0.00	0.31 	86.106.116.81	samedomain.com	GET /button.php?u=dstrikt&style=banner1 HTTP/1.1
19-18	-	0/0/185	. 	0.01	2119	0	0.0	0.00	1.22 	80.141.148.57	samedomain.com	GET /button.php?u=Georullz&style=1 HTTP/1.1

And also:

Code:

CPU Usage: u33.13 s5.14 cu0 cs0 - .213% CPU load

And that's not all of it, this is just a sample of many requests of that kind. And they all for the same domain. It's a domain we host so I don't know what's the deal with button.php.

What can I do?

p_s_shah · 05-26-2007, 02:11 AM

Upto my understanding,
Index/other pages of http://walpapers.evolink.ro/ is trying to access button.php with different post strings and button.php doesn't exist on your server or placed at different location other than /var/www/html/button.php

Do following :
1. If you are hosting http://walpapers.evolink.ro/, then please run a recursive search on domain's root folder for button.php.
grep "button.php" * -r
Try to find out all the pages who references button.php.
Do proper backup of site contents.
Remove those references and check again.

If you are not hosting http://walpapers.evolink.ro/, just blacklist IP of http://walpapers.evolink.ro/ and check, if it makes difference.

2. Check if your site is used to provide rss feed and in your rss feed you mentioned button.php. As other web clients try to update rss feed on client machine, you may have these no. of connections.

3. Take help of php developer to find out post strings passed to button.php, its purpose and its alternative.

Update us with your findings.

Note : Please remove site name after your issue is resolved.