Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We've been getting some attacks on our server I think, because our server gets down every day now. I want to monitor what is causing the server to go down or if there is any attack from some site or if its crawler doing the attack.

Is there any tool for this? If not, what should I do to find out what is causing the problem.

Edited

  1. My server is linux
  2. I have cpanel control panel
  3. I haven't checked the logs
  4. I have done nothing to see what is causing the problem
  5. That's why i came here to ask how can i find out what is causing the problem. there is guy from our server, he said its server ram, they told us to extend more ram, but there isnt many sites on it and not many load from that sites eaither, so i dont see why our 2gb ram is getting used at. so i want to find out :/

Edited Again

  1. What version of Linux (CentOS, Debian, Redhat, etc)

    Answer: CentOS

  2. Explain what you mean by "the server gets down". Does that mean the whole server stops responding and you have to go in and manually restart, or do you mean the server keeps running but only the website stops responding? Does ftp, ssh, etc keep working?

    Answer: well we head few times server being down. 1st time when it got down, you can ping it, but apache was not working. then again server got down and guy said it was cause server hosts were wrong, so they fixed it and it wont go down again. then it happen again, even after restarting, server didnt got fixed, someone head to go literly start the server. 4th time, i just did the restart and it got back online. It happens every day now, but usally in the morning, server works fine for complete day, but in morning it gets down

  3. How are you restarting things or does it just eventually start working by itself?

    Answer: no we have to restart manually so then it start working, else it wont work.

share|improve this question
2  
Help us to help you by providing some information. What operating system? What is in the logs to suggest the server has been attacked? Have you even checked the server logs? What, if anything, have you done to check for virus or malware activilty, spyware, rootkits, etc? –  John Gardeniers Mar 11 '10 at 1:31
    
Indeed. At the very, very least we need to know what operating system it is. –  Mark Henderson Mar 11 '10 at 1:37
    
sorry, i just added the list of answers of john questions on my post. i hope that helps. –  Basit Mar 11 '10 at 1:40
    
What makes you think it's an attack? What do you mean by "gets down every day"? Like, the server shuts down, gets unresponsive, the web server process crashes, immediately comes back up after a reboot,...? Does this happen at a particular time of day? Are you seeing traffic increasing on the router? You really really need to see what the logs say on the server for the system and web server before assuming it's an attack. If it's DDoS, your bandwidth should drop to a trickle, regardless of the server status. –  Bart Silverstrim Mar 11 '10 at 3:48
    
ya its happening particular time of the day, thats why im assuming it could be attack, i really dont know which file too look for and what to look for in that file, last time i opened up access log and could'nt figure out what to look for, it all looked ok to me lol.. so need your guys expertise * sighs * –  Basit Mar 11 '10 at 5:27

4 Answers 4

up vote 4 down vote accepted

People would like to help you but your questions/responses are so vague it's hard to help. I know your a newbie but start off by telling us:

  1. What version of Linux (CentOS, Debian, Redhat, etc)
  2. Explain what you mean by "the server gets down". Does that mean the whole server stops responding and you have to go in and manually restart, or do you mean the server keeps running but only the website stops responding? Does ftp, ssh, etc keep working?
  3. How are you restarting things or does it just eventually start working by itself?
  4. /var/log/messages might be a good place to look for server errors or possibly out of memory errors.

I suspect you're running out of memory like your service provider says and it's most likely due to apache/mod_php webserver configuration. I've seen this exact problem numerous times and it can be really frustrating to track down because a lot of times the server won't leave any useful information like "out of memory" error messages in the log files.

If you have an inclination it's the webserver causing problem here are my suggestions for apache settings. I don't use cpanel so i can't give you specific instructions. Make sure to write down the default setting in case you need to roll back.

  1. Turn off keepalive "KeepAlive Off"
  2. Set StartServers to "StartServers 8"
  3. Set MinSpareServers to "MinSpareServers 5"
  4. Set MaxSparServers to "MaxSpareServers 20"
  5. Set Server Limit to "ServerLimit 40"
  6. Set MaxClients to "MaxClients 40"

These setting should keep apache/php from eating up all 2G of memory. Opening pages with multiple images will be a little slower due to keepalive off but you just need to try first and see if your server stays up. If it works you can turn on keepalive and maybe change KeepAliveTimeout to 5 or something like that. If it keeps working bump up ServerLimit and MaxClients a by 5 or 10 each time.

Good luck

Edit:

I can't tell you for sure but it really sounds like you're server is running out of memory. I've see this on several mis-configured CentOS webservers. It normally happens within a span of 2-3 minutes. The bad thing is that it doesn't leave a trace of what happened in the log files, it just locks up until you reboot. If you don't try what i suggested and you want to see what's really happening, the best/easiest way i know is using a program called atop. Cacti, Munin, and Nagios are great but they won't give you the detailed figures that atop will. They're also much harder to setup.

http://www.atoptool.nl/ Similar to top but it takes snapshots of the atop window at user defined intervals. Set INTERVAL=60 in /etc/atop/atop.daily to get 1 minute snapshots. Run atop -r /var/log/atop/atop_20100311 to view 1 minute intervals for a particular date. Use t and T keys to view forward and backwards through time. When you're scanning through you'll be able to see what processes were running and how many resource they were using. Once memory usage goes over a certain threshold the readouts will turn red and you know you have a problem. Keep an eye on MEM and SWP.

share|improve this answer
    
i got this --- Mar 7 11:19:06 na suhosin[13559]: ALERT - configured GET variable limit exceeded - dropped variable 'srh' (attacker '67.218.116.130', file '/home/gq/public_html/beta/index.p$ –  Basit Mar 11 '10 at 8:00
    
This isn't the problem. Now if you can answer my first 3 questions i might think about helping you more. Specifically what you mean by "server gets down". You've been asked twice and failed to answer twice. –  anonymouse Mar 11 '10 at 9:13
    
thank you soo much for help.. i have added the answers of your questions, check above on my post please. :) –  Basit Mar 11 '10 at 9:27
    
take a look at this graph image, my server guys said, its mysql using all the cpu.. do you know what it could be? in /var/log/messages i was seeing lots of brutel attack banned from the site msgs.. dunno what is causing the server problem. img695.imageshack.us/img695/3381/servergraphs.png –  Basit Mar 25 '10 at 13:17

Start by having a look at your server logs. Something in there might indicate why the server is going down.

share|improve this answer
5  
+1 Don't bother asking for help until you have looked at the logs. It's the first thing we'll want to see. –  Chris Nava Mar 11 '10 at 3:18
    
hmm ok can you tell me which log file i have to look for, cause i saw on google search, there are too many logs, access log, error log, ..... which file and what/how to look for attack or problem which is causing? thats why i was asking for monitoring tool, so it can show me in ne ui, rather then me trying to guess on which log should i have to view, cause im a programmer, less of a administrator, but my dedicated server now getting this problem, so i need help :/ –  Basit Mar 11 '10 at 5:25
    
fauxzen.com/cpanel-log-file-locations too many logs files –  Basit Mar 11 '10 at 5:29
    
That's a better question! I would start with the HTTP access/error logs to see if it's someone spidering your server or a misbehaving search engine is descending into a CGI script (aka a spider trap). Failing that, I would look at whichever log file is growing quickest. If you can sort by change date start with the newest. –  Chris Nava Mar 11 '10 at 6:04
    
chris any command or any link where its written, so i can do accordingly, im newbie on server side i guess –  Basit Mar 11 '10 at 6:46

fist of all you should start monitoring your server. good choices for that would be Munin and/or Nagios

especially munin allows you to monitor the performance of your servers and let you know what user or process gathers all your ressources

another useful tool could be Snort - a intrusion prevention and detection system, but this is not easy to set up

to secure apache "a little bit more" you can limit the amount of accesses/minute/ip via iptables/netfilter, i have this setup on all my boxes - but keep in mind: 1.) this will not prevent distributed attacks 2.) think of a minimum on required requests if you use ajax on your website

share|improve this answer
    
+1 for Nagios. As for Snort, csf+lfd is much easier to set up on a cPanel/WHM system. IMHO anyway... –  Josh Mar 11 '10 at 13:58

Look into ConfigServer Security & Firewall (csf+lfd). It's a package which can be installed into WebHost Manager and it has a number of tools to enable you to evaluate the security of your server and automatically block hosts which are performing certain kinds of attacks. I highly recommend it.

In case what you're seeing is not an attack but a resource issue, look into Cacti, SNMP and MRTG. Cacti can be very difficult to set up but it creates graphs of the resource usage on your server -- very helpful to determine if your load is too high, you're running out of RAM, or whatever. Cacti gathers its data via SNMP and uses MRTG to generate its graphs.

Here's a post about SNMP on CentOS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.