0

I have tried configuring both Apache and MySQL but I still get very high peaks in load: http://d.pr/aD9L

I'm pretty sure these peaks are not caused by increase in traffic, because no peaks can be found in Google Analytics.

How can I find out what is causing these peaks?

3 Answers 3

1

The graph you've shown does not show which processes created the load. If the load is low, I would ask if there are:

  • Any cron jobs running at this time e.g. backups etc, that would account for the load
  • Any cache clear conditions- i.e. a cache is cleared and things are now being served from the app.

It strikes me that these might be the most likely scenarios.

Also, if you are running on a VM, sometimes weird things like this can happen!

1
  • I am on a VM but should have plenty of CPU - it is Meditatemple's second largest server. There is a cron job that runs every minute, but that should only result in a stable load - I have also tried to run without it and there were no difference. Nov 23, 2010 at 15:43
0

Might be good if you can post your config file w/ your question - just be sure to wipe your ip addresses and domain names of course.

There are a number of reasons httpd load can be high from mis-configuration to denial of service -

Let me fire off a few questions your way:::

  1. In your logs - are you seeing anything out of the ordinary?
  2. Are you using anything such as mod_security, mod_bandwidth, mod_deflate, mod_evasive?
  3. Do you have a firewall setup ? does that firewall report anything out of the ordinary ?
  4. run this command when the load is

    high ps -aux|grep HTTP|wc -l

  5. run this command when the load is climbing

    netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

  6. and run this command

    netstat -lpn|grep :80 |awk ‘{print $5}’|sort

  7. If you see a large number of unknown ip's in those lists - block them in iptables via the command line like this:

    iptables -A INPUT -s -j DROP

5
  • Thank you, I will try your suggestions. What is the command at 6. showing before IP - is that the number of connections? Nov 23, 2010 at 15:53
  • Sorry, What is the figure showing before the IP in the command mentioned in 5. Nov 23, 2010 at 19:38
  • sorry - was off working ;-) normally you would see some result such as # ipaddress example: 20 8.8.8.8 The first # is the number of connections from that ip :-) A really high # is not normally a good sign. Nov 24, 2010 at 6:34
  • Ok, so an IP with 450 connections should be blocked? ;-) Nov 25, 2010 at 18:46
  • My sincere apologies - never saw this question from you until now. YES 450 connections is out of the ordinary and I would most likely block them Nov 28, 2010 at 21:20
0

Just to add to chrim2671's answer, one of the best ways to see what's happening is using 'top' - but (AFAIK) that only sorts processes by CPU or memory usage. And you are saying that your problem is load.

In the case of a webserver, all you'll see in top (or ps) is the httpd process running - if you want more details, you'll need to have a look at the logs or server-status.

You should certainly enalbe mysql slow query logging (if its not already on) and see if you can establish any correlations.

because no peaks can be found in Google Analytics.

Google Analytics is a fantastic tool for usage analysis - but it's not a tool for system diagnostics.

Do you understand what 'load' is? Its the average number of processes which are waiting to be scheduled to be run. It can be caused by high amounts of I/O, as well as cpu / memory / network bottlenecks.

Do you have any reason to believe that the increase in this metric is affecting the service provided to your users? Costing you money? If its not having any adverse effect, is it worth worrying about? If you don't know - then you need to have a think about what and why you are monitoring.

1
  • I have looked in Top many times and have found out that there is not correlation between the processes and the load. My suggestion is that someone is trying to scrape content from the site - possibly from multiple IPs. I have started blocking IPs which have more than 100 pageviews per minute, but with no luck. I know G.A. is not a tool for system diagnostics, but it is a relevant information that no increase in normal traffic is registered. Nov 23, 2010 at 15:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .