Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a complete rookie when it comes to all things Linux related so please treat me as such and assume I know nothing. That being said my Top says this:

top - 12:08:03 up 11 days, 15:36,  0 users,  load average: 5.47, 5.53, 5.46
Tasks: 296 total,   2 running, 294 sleeping,   0 stopped,   0 zombie
Cpu(s):  6.3%us,  1.4%sy,  0.0%ni, 71.3%id, 20.6%wa,  0.0%hi,  0.3%si,  0.0%st
Mem:   8176880k total,  8118236k used,    58644k free,    89312k buffers
Swap:  1004052k total,        0k used,  1004052k free,  7235652k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND            
 1229 root      15  -5     0    0    0 D    1  0.0 199:28.63 kjournald          
 2946 root      20   0  1716  676  552 D    1  0.0 145:02.94 syslogd            
14553 root      20   0  2644 1268  876 R    1  0.0   0:00.34 top                
14609 postfix   20   0  7896 1884 1460 D    1  0.0   0:00.02 bounce             
14630 postfix   20   0  7896 1876 1452 R    0  0.0   0:00.00 bounce   

And my hard drives says:

> df -k
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sda3              4925556   4474836    200508  96% /
/dev/sda5               489992     36090    428602   8% /tmp
/dev/sda6            377951852 236171160 122581816  66% /var
none                   4088440         0   4088440   0% /dev/shm

It has been like it for a few days now...

I know not what is causing the high server load (Normally around 1.3) can anyone give any tips on how to track down the culprit?

Many thanks,

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

You might want to check your mail queue and see how many messages are waiting to be resent. Server load can be high due to resource interrupts (busy hard disk, network driver, etc.) so if your drive is very busy with a huge number of bounces or retries to resend, that can drive the system load higher even though the console is quite responsive. System load doesn't necessarily reflect that just the CPU is busy.

Depending on what exactly you're doing with this server, you may also want to run a hacking check...chkrootkit and rkhunter, anything odd in the logs, etc. because if you're suddenly getting a very large number of bounces, you may either have something misconfigured or someone is slamming it as a mail relay (or is successfully using it as a mail relay, and you're about to be blacklisted if you're not already as a spammer).

share|improve this answer
    
Oh this seems very good. OK Bard, how do I check to see the mail queue as we have been having issues there over the last few days too so that really seems likely! chkrootkit and rkhunter are installed by default yes? –  Dorjan Mar 31 '10 at 11:51
    
they might be, but I doubt it for Gentoo. You may need to google the documentation for gentoo and see how to install them for you distro, then run updates to make sure you have latest signatures. Postfix, checking queues, might find a good launch point at postfix.org/QSHAPE_README.html (or any of the docs at postfix.org). Definitely want to check your logs. It sounds like you might be getting in over your head here; I'd advise finding outside help if you're unfamiliar with analyzing your server logs or your distribution's configuration details. –  Bart Silverstrim Mar 31 '10 at 12:04
    
sudo postsuper -d ALL and all is well... Bart, your stab in the dark was spot on.. .however we're now a spam bot host... I need to figure that out now! and yes, I am in over my head but I'm the "IT" guy and no money to go else where :lol: You're an angel for me. –  Dorjan Mar 31 '10 at 12:11
    
If you're fairly certain you're hacked, you need to disconnect it from the network until you can isolate the spam-causing modifications, as every second you're sending is another second closer to blacklisting your site, or at a minimum block outgoing port 25 traffic at your router. You may need to find a way to salvage your mail store and restore your server from backup, as you can't be sure what has been modified and hidden (especially if you're rootkitted). –  Bart Silverstrim Mar 31 '10 at 12:19
    
Monitor your network for odd traffic with another computer (you can't trust the server itself to not hide something) at your outgoing relay point if at all possible. Just because you block port 25 doesn't mean there's not something acting as a control channel on some other port from that machine, and the bad guy isn't monitoring your actions from a remote control point. Worse the server could have been monitoring traffic for passwords or sensitive information within your network by reading emails, redirecting them, or redirecting other system traffic using arp poisoning. –  Bart Silverstrim Mar 31 '10 at 12:21
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.