Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have tried configuring both Apache and MySQL but I still get very high peaks in load: http://d.pr/aD9L

I'm pretty sure these peaks are not caused by increase in traffic, because no peaks can be found in Google Analytics.

How can I find out what is causing these peaks?

share|improve this question

3 Answers 3

The graph you've shown does not show which processes created the load. If the load is low, I would ask if there are:

  • Any cron jobs running at this time e.g. backups etc, that would account for the load
  • Any cache clear conditions- i.e. a cache is cleared and things are now being served from the app.

It strikes me that these might be the most likely scenarios.

Also, if you are running on a VM, sometimes weird things like this can happen!

share|improve this answer
    
I am on a VM but should have plenty of CPU - it is Meditatemple's second largest server. There is a cron job that runs every minute, but that should only result in a stable load - I have also tried to run without it and there were no difference. –  Martin LeBlanc Nov 23 '10 at 15:43

Might be good if you can post your config file w/ your question - just be sure to wipe your ip addresses and domain names of course.

There are a number of reasons httpd load can be high from mis-configuration to denial of service -

Let me fire off a few questions your way:::

  1. In your logs - are you seeing anything out of the ordinary?
  2. Are you using anything such as mod_security, mod_bandwidth, mod_deflate, mod_evasive?
  3. Do you have a firewall setup ? does that firewall report anything out of the ordinary ?
  4. run this command when the load is

    high ps -aux|grep HTTP|wc -l

  5. run this command when the load is climbing

    netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

  6. and run this command

    netstat -lpn|grep :80 |awk ‘{print $5}’|sort

  7. If you see a large number of unknown ip's in those lists - block them in iptables via the command line like this:

    iptables -A INPUT -s -j DROP

share|improve this answer
    
Thank you, I will try your suggestions. What is the command at 6. showing before IP - is that the number of connections? –  Martin LeBlanc Nov 23 '10 at 15:53
    
Sorry, What is the figure showing before the IP in the command mentioned in 5. –  Martin LeBlanc Nov 23 '10 at 19:38
    
sorry - was off working ;-) normally you would see some result such as # ipaddress example: 20 8.8.8.8 The first # is the number of connections from that ip :-) A really high # is not normally a good sign. –  Glenn Kelley Nov 24 '10 at 6:34
    
Ok, so an IP with 450 connections should be blocked? ;-) –  Martin LeBlanc Nov 25 '10 at 18:46
    
My sincere apologies - never saw this question from you until now. YES 450 connections is out of the ordinary and I would most likely block them –  Glenn Kelley Nov 28 '10 at 21:20

Just to add to chrim2671's answer, one of the best ways to see what's happening is using 'top' - but (AFAIK) that only sorts processes by CPU or memory usage. And you are saying that your problem is load.

In the case of a webserver, all you'll see in top (or ps) is the httpd process running - if you want more details, you'll need to have a look at the logs or server-status.

You should certainly enalbe mysql slow query logging (if its not already on) and see if you can establish any correlations.

because no peaks can be found in Google Analytics.

Google Analytics is a fantastic tool for usage analysis - but it's not a tool for system diagnostics.

Do you understand what 'load' is? Its the average number of processes which are waiting to be scheduled to be run. It can be caused by high amounts of I/O, as well as cpu / memory / network bottlenecks.

Do you have any reason to believe that the increase in this metric is affecting the service provided to your users? Costing you money? If its not having any adverse effect, is it worth worrying about? If you don't know - then you need to have a think about what and why you are monitoring.

share|improve this answer
    
I have looked in Top many times and have found out that there is not correlation between the processes and the load. My suggestion is that someone is trying to scrape content from the site - possibly from multiple IPs. I have started blocking IPs which have more than 100 pageviews per minute, but with no luck. I know G.A. is not a tool for system diagnostics, but it is a relevant information that no increase in normal traffic is registered. –  Martin LeBlanc Nov 23 '10 at 15:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.