Server attack monitor

Question

We've been getting some attacks on our server I think, because our server gets down every day now. I want to monitor what is causing the server to go down or if there is any attack from some site or if its crawler doing the attack.

Is there any tool for this? If not, what should I do to find out what is causing the problem.

Edited

1. My server is linux
2. I have cpanel control panel
3. I haven't checked the logs
4. I have done nothing to see what is causing the problem
5. That's why i came here to ask how can i find out what is causing the problem. there is guy from our server, he said its server ram, they told us to extend more ram, but there isnt many sites on it and not many load from that sites eaither, so i dont see why our 2gb ram is getting used at. so i want to find out :/

Edited Again

1. What version of Linux (CentOS, Debian, Redhat, etc)

   Answer: CentOS

2. Explain what you mean by "the server gets down". Does that mean the whole server stops responding and you have to go in and manually restart, or do you mean the server keeps running but only the website stops responding? Does ftp, ssh, etc keep working?

   Answer: well we head few times server being down. 1st time when it got down, you can ping it, but apache was not working. then again server got down and guy said it was cause server hosts were wrong, so they fixed it and it wont go down again. then it happen again, even after restarting, server didnt got fixed, someone head to go literly start the server. 4th time, i just did the restart and it got back online. It happens every day now, but usally in the morning, server works fine for complete day, but in morning it gets down

3. How are you restarting things or does it just eventually start working by itself?

   Answer: no we have to restart manually so then it start working, else it wont work.

Answer 1

People would like to help you but your questions/responses are so vague it's hard to help. I know your a newbie but start off by telling us:

1. What version of Linux (CentOS, Debian, Redhat, etc)
2. Explain what you mean by "the server gets down". Does that mean the whole server stops responding and you have to go in and manually restart, or do you mean the server keeps running but only the website stops responding? Does ftp, ssh, etc keep working?
3. How are you restarting things or does it just eventually start working by itself?
4. /var/log/messages might be a good place to look for server errors or possibly out of memory errors.

I suspect you're running out of memory like your service provider says and it's most likely due to apache/mod_php webserver configuration. I've seen this exact problem numerous times and it can be really frustrating to track down because a lot of times the server won't leave any useful information like "out of memory" error messages in the log files.

If you have an inclination it's the webserver causing problem here are my suggestions for apache settings. I don't use cpanel so i can't give you specific instructions. Make sure to write down the default setting in case you need to roll back.

1. Turn off keepalive "KeepAlive Off"
2. Set StartServers to "StartServers 8"
3. Set MinSpareServers to "MinSpareServers 5"
4. Set MaxSparServers to "MaxSpareServers 20"
5. Set Server Limit to "ServerLimit 40"
6. Set MaxClients to "MaxClients 40"

These setting should keep apache/php from eating up all 2G of memory. Opening pages with multiple images will be a little slower due to keepalive off but you just need to try first and see if your server stays up. If it works you can turn on keepalive and maybe change KeepAliveTimeout to 5 or something like that. If it keeps working bump up ServerLimit and MaxClients a by 5 or 10 each time.

Good luck

Edit:

I can't tell you for sure but it really sounds like you're server is running out of memory. I've see this on several mis-configured CentOS webservers. It normally happens within a span of 2-3 minutes. The bad thing is that it doesn't leave a trace of what happened in the log files, it just locks up until you reboot. If you don't try what i suggested and you want to see what's really happening, the best/easiest way i know is using a program called atop. Cacti, Munin, and Nagios are great but they won't give you the detailed figures that atop will. They're also much harder to setup.

http://www.atoptool.nl/ Similar to top but it takes snapshots of the atop window at user defined intervals. Set INTERVAL=60 in /etc/atop/atop.daily to get 1 minute snapshots. Run atop -r /var/log/atop/atop_20100311 to view 1 minute intervals for a particular date. Use t and T keys to view forward and backwards through time. When you're scanning through you'll be able to see what processes were running and how many resource they were using. Once memory usage goes over a certain threshold the readouts will turn red and you know you have a problem. Keep an eye on MEM and SWP.

Answer 2

Start by having a look at your server logs. Something in there might indicate why the server is going down.

Answer 3

fist of all you should start monitoring your server. good choices for that would be Munin and/or Nagios

especially munin allows you to monitor the performance of your servers and let you know what user or process gathers all your ressources

another useful tool could be Snort - a intrusion prevention and detection system, but this is not easy to set up

to secure apache "a little bit more" you can limit the amount of accesses/minute/ip via iptables/netfilter, i have this setup on all my boxes - but keep in mind: 1.) this will not prevent distributed attacks 2.) think of a minimum on required requests if you use ajax on your website

Answer 4

Look into ConfigServer Security & Firewall (csf+lfd). It's a package which can be installed into WebHost Manager and it has a number of tools to enable you to evaluate the security of your server and automatically block hosts which are performing certain kinds of attacks. I highly recommend it.

In case what you're seeing is not an attack but a resource issue, look into Cacti, SNMP and MRTG. Cacti can be very difficult to set up but it creates graphs of the resource usage on your server -- very helpful to determine if your load is too high, you're running out of RAM, or whatever. Cacti gathers its data via SNMP and uses MRTG to generate its graphs.

Here's a post about SNMP on CentOS.