How to detect High Loading Script

4 posts / 0 new

Topic locked

#1 Wed, 01/12/2011 - 23:05

hothandao

How to detect High Loading Script

Hi,

My EC2 micro instance doesn't often respond: Cannot access websites, Webmin, FTP or even SSH due to high load. If Apache is stopped, website cannot be accessed (of course!), but other services work properly.

I have looked at error_log, but there are only "PHP Notice: Undefined variable" errors, I think this type of error cannot be the reason.

So, someone please help me to detect which scripts have caused the system high load? - or any suggestion for fixing this problem.

Thanks,

#2 Wed, 01/12/2011 - 23:16

andreychek

Howdy,

What sort of load are you seeing on your system? You can determine that by running the command "uptime".

If you run the command "top", it will tell you what processes are resource intensive... are there any in particular that are showing up at the top of that output?

Also, what is the output of the command "mailq | tail -1". That will show how many email messages are sitting in the email queue.

-Eric

#3 Thu, 01/13/2011 - 03:30

hothandao

I have found a lot of POST sent from strange IPs "76.102.155.133 - root [05/Sep/2007:20:40:33 -0400] "POST /fastrpc.cgi HTTP/1.0" 200 47".

That may be a brute force attack. Activated Security Block for failed logging in times. I changed webmin port as well.

Thanks a lot for your help, Eric

#4 Mon, 01/17/2011 - 11:48

maxslug

Here's what I do, I have the follow script that looks for load > 1 and then it dumps out the following : - netstat - tcp connections - apache status logger (make sure you have extended status turned on) - process table (ps)

I should add free -m in there too now that I think about it, but you can infer mem usage from the ps output.

Then I add an entry in /etc/crontab to run this every five minutes. If no high load is detected, nothing is written, otherwise a log is written.

Apache - Check for high load and log

*/5 * * * * root /root/bin/apache_status_logger

Then after a problem happens I can use these breadcrumbs of logs to figure out why.

-m

Topic locked