Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a vps with DirectAdmin installed on it. today my server went down for an hour and when I checked the notification center I saw that some of the httpd instance are using a lot of my cpu power.
you can check a part top command below. what I want to know is which one of my domains are causing this?

top command result:

top - 07:52:54 up 21:08, 0 users, load average: 61.00, 19.79, 6.98 Tasks: 223 total, 5 running, 218 sleeping, 0 stopped, 0 zombie Cpu(s): 3.7%us, 0.3%sy, 0.0%ni, 95.6%id, 0.3%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 1026200k total, 1014088k used, 12112k free, 764k buffers Swap: 3002360k total, 1166920k used, 1835440k free,
14084k cached

12684 apache 20 0 55192 15m 1044 D 2.9 1.5 0:01.10 /usr/sbin/httpd -k start -DSSL
12660 apache 20 0 50248 15m 1324 D 2.7 1.6 0:01.13 /usr/sbin/httpd -k start -DSSL
10782 apache 20 0 58860 15m 1456 R 2.5 1.5 0:37.45 /usr/sbin/httpd -k start -DSSL
12686 apache 20 0 55144 17m 1044 D 2.2 1.7 0:01.04 /usr/sbin/httpd -k start -DSSL
28 root 20 0 0 0 0 R 2.0 0.0 0:00.60 [kswapd0]
12654 apache 20 0 55144 14m 1044 D 2.0 1.5 0:01.03 /usr/sbin/httpd -k start -DSSL
12658 apache 20 0 55144 11m 1044 D 2.0 1.1 0:00.94 /usr/sbin/httpd -k start -DSSL
12669 apache 20 0 55144 18m 1044 D 1.7 1.8 0:01.03 /usr/sbin/httpd -k start -DSSL
12695 apache 20 0 55144 18m 1044 D 1.7 1.8 0:01.05 /usr/sbin/httpd -k start -DSSL
12681 apache 20 0 55176 15m 1044 D 1.5 1.5 0:00.94 /usr/sbin/httpd -k start -DSSL
12670 apache 20 0 55184 13m 1044 D 1.2 1.3 0:00.85 /usr/sbin/httpd -k start -DSSL
12692 apache 20 0 55144 16m 1044 D 1.0 1.7 0:01.00 /usr/sbin/httpd -k start -DSSL
12696 apache 20 0 55144 19m 1044 D 1.0 1.9 0:01.00 /usr/sbin/httpd -k start -DSSL
12700 apache 20 0 56304 7296 1028 D 1.0 0.7 0:00.79 /usr/sbin/httpd -k start -DSSL
12719 apache 20 0 54812 11m 1216 S 0.7 1.2 0:00.60 /usr/sbin/httpd -k start -DSSL
12734 apache 20 0 54804 12m 1212 R 0.7 1.3 0:00.62 /usr/sbin/httpd -k start -DSSL
12772 apache 20 0 54812 20m 1724 R 0.7 2.1 0:00.63 /usr/sbin/httpd -k start -DSSL


locked by HopelessN00b Apr 3 at 17:21

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by HopelessN00b Apr 3 at 17:21

  • This question does not appear to be about server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers 3

up vote 0 down vote accepted

As mentioned by the previous answer, looking at a specific Apache process doesn't have a lot of value.

I might suggest that you should alter your httpd.conf settings - either using more efficient processes (e.g. PHP-FPM instead of mod_php) or altering the number of servers/clients/requests).

Typically, in an environment with multiple domains, each domain gets it own user. (This is typically seen if you are running PHP in FastCGI mode, and makes it easy to see which PHP process is using significant resources).

The following is simply for interest sake - it serves little useful purpose in this case:

Should you really want to determine what site a particular process is serving at any given instant, you could run a trace looking for file access. Be advised however, that significant quantities of output will generated very rapidly on a high traffic server.

For instance, the following will show file opens (typically only .htaccess files if you use FastCGI), as well as directory listings, and is enough to identify which domain the process is serving right now:

strace -p PID -e trace=open,lstat64

Example Output:

Process PID attached - interrupt to quit
open("/path/to/website/folder/.htaccess", O_RDONLY|O_LARGEFIL     E|O_CLOEXEC) = 66
open("/path/to/website/folder/subfolder/.htaccess", O_RDONLY|O     _LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
lstat64("/path", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat64("/path/to", {st_mode=S_IFDIR|0755, st_size=90, ...}) = 0
lstat64("/path/to/website", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat64("/path/to/website/folder", {st_mode=S_IFDIR|0755, st_size=4096, .     ..}) = 0
lstat64("/path/to/website/folder/subfolder", {st_mode=S_IFDIR|0750, st_size     =21, ...}) = 0
lstat64("/path/to/website/folder/subfolder/php.fcgi", {st_mode=S_IFREG|0750     , st_size=96, ...}) = 0

Alternatively, you can look at the process reads, and grep for 'Host':

strace -p PID -e trace=read -s 100 2>&1 | grep "Host:"

Example Output:

read(65, "GET /path/of/request/ HTTP/1.0\r\nHost: www.domain.com\r\nX-Real-IP: xxx.xxx.xxx.xx"..., 8000) = 1167

(You might need to make the 'string length' (s) value longer)

Once again, keep in mind that both of these are an 'instant in time' look at what a given process is serving - in the next instant that will change - it is therefore useless for anything beyond curiosity.


The processes you are looking at in the top output reflect how many daemons have spawned to handle HTTP/S requests to your server. They are not explicitly linked to a particular website. When a request comes to your server an idle daemon will take the request and based on the header information sent to the server, it will then connect it to the correct file.

In short, none of the processes are explicitly linked to a particular site, but all of them are potentially linked to it.

Regards, Phil,


netstat -tp will tell you which process is serving which TCP connection, allowing you to map processes to hostnames.

that said, you'd be better off using Apache's mod_status (http://httpd.apache.org/docs/2.0/mod/mod_status.html), as it's built specifically for this problem.

It doesn't look like CPU is your issue here, though. You've got 12M of free memory, and you're dipping heavily into swap.

yes, you're right. my problem was with with the number apache instanced initiated. I just set the MaxClients and ServerLimit directives to 15 and i'm waiting for what's to come next. –  Hamed Momeni Jul 13 '11 at 5:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.