high load

[laddu]

Could you think this could be DDoS ? And any way to see if indeed it is ?

[laddu]

I think this is caused by php-cgi. I currently use fcgid

My conf

Code:

LoadModule fcgid_module modules/mod_fcgid.so
<IfModule mod_fcgid.c>
  AddHandler fcgid-script .php .php5
  SocketPath /var/run/mod_fcgid/sock
  IPCConnectTimeout 90
  IdleTimeout 300
  IdleScanInterval 120
  ProcessLifeTime 900
  MaxProcessCount 200
  DefaultMinClassProcessCount 1
  DefaultMaxClassProcessCount 5
  IPCCommTimeout 300
  BusyTimeout 300
  BusyScanInterval 120
  ErrorScanInterval 3
  MaxRequestsPerProcess 500
  ZombieScanInterval 3
  DirectoryIndex index.php
</IfModule>

From ps aux|grep php-cgi I have at least 500 php-cgi processes. I have to kill them all, restarting apache does not work.

Please some suggestion ?

[ephigenie]

Please post your fastcgi.conf / ispcp_fastcgi.conf / ispcp_fcgid.conf
or whatever fastcgi modul you use here.

[laddu]

I am using fcgid and the conf is above (file : /etc/httpd/conf.d/fcgid_ispcp.conf)

Post it again

Code:

cat /etc/httpd/conf.d/fcgid_ispcp.conf |grep -v ^#

LoadModule fcgid_module modules/mod_fcgid.so
<IfModule mod_fcgid.c>
  AddHandler fcgid-script .php .php5
  SocketPath /var/run/mod_fcgid/sock
  IPCConnectTimeout 90
  IdleTimeout 300
  IdleScanInterval 120
  ProcessLifeTime 900
  MaxProcessCount 200
  DefaultMinClassProcessCount 1
  DefaultMaxClassProcessCount 5
  IPCCommTimeout 300
  BusyTimeout 300
  BusyScanInterval 120
  ErrorScanInterval 3
  MaxRequestsPerProcess 500
  ZombieScanInterval 3
  DirectoryIndex index.php
</IfModule>

Please give me some help

---

------

LE: I noticed that a process called diff is loading 89% of memory. After I kill diff everything comes back to normal

---

LLE: and this is the process:

Code:

ps aux |grep diff
root     14433  0.0  0.0   2404   516 ?        S    18:02   0:00 sh -c /usr/bin/diff -a /var/log/ispcp/maillog /var/log/ispcp/maillog.prev | /bin/egrep '^<' | /bin/sed 's/^< //' 1> /var/log/ispcp/maillog.diff
root     14434  4.8 66.7 2340452 1384864 ?     D    18:02   0:04 /usr/bin/diff -a /var/log/ispcp/maillog /var/log/ispcp/maillog.prev

[laddu]

Code:

top - 19:33:33 up 1 day,  4:20,  2 users,  load average: 13.03, 5.36, 6.31
Tasks: 265 total,   1 running, 264 sleeping,   0 stopped,   0 zombie
Cpu(s):  0.0%us,  1.7%sy,  0.0%ni,  6.6%id, 91.5%wa,  0.1%hi,  0.2%si,  0.0%st
Mem:   2074936k total,  2021580k used,    53356k free,     3640k buffers
Swap:  2031608k total,  1303272k used,   728336k free,   476548k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
  229 root      10  -5     0    0    0 S    4  0.0  54:06.17 kswapd0
8693 root      18   0 2299m 1.3g  348 D    2 67.8   0:04.55 diff
17761 apache    18   0 12724 2580 1528 S    0  0.1   0:00.07 httpd
18730 root      15   0  2320 1128  804 R    0  0.1   0:00.04 top

From my understanding this diff script backing up maillog. I do not want to do this, how can I stop it ?

[laddu]

BUMP

How can I stop this backup ? Please give me a suggestion. My server is overloaded and all the sites are retunrning Internal Server error 500

[pgentoo]

I found similar issues with fastcgi php processes as you've mentioned, however not to the same extent because I only have a few domains on the server currently. However, with a max children setting of 3 in my fcgi starter script, i'd check and see 20 some processes for a single site.

It looks like there is a bug with php when setting this value, in that if the process has an error, it gets orphaned and not cleaned up properly.

I decided to comment out the lines in the fcgi starter script, and run just on the global settings in mod_fcgid settings. This works perfect for me, and i haven't seen any errors caused by the changes yet.

Maybe give that a try...

[laddu]

Could you please be more specific? Where and waht changes I should make ?

Regards

[pgentoo]

I documented my findings/changes in another thread. Check it out: http://isp-control.net/forum/showthread.php?tid=5613

Hopefully this helps.

-
pGentoo