Could someone give a tip on how to log first 5 rows from top output? I was thinking about grep, but don't know how to pick rows.
I need to understand. What freezes server sometimes. Maybe there are some tools for it?
You can do what you've requested by:
In addition to Janne's list of commands and symcbean's advice to check your system logs, I would suggest atop:
Also with atop you can check backwards in time which was the situation of your server because it stores that data in it's log files. For example, I have the following snippet of code in a script that is launched when a server loadavg passes an arbitrary limit. The atop information and other related system info is sent then by mail to my account:
Basically I get a report of the actual state of the server and what was happening in it during the past 30 minutes (with detailed information of each 10 minutes interval)
First, its unlikely that the server freezing is due to user processes. Secondly, even if that were the case, why would it be one of the top 5 causing the problem?
If you've already checked your logs and found nothing, then try implementing a watchdog to write a heartbeat to the logs - and check that the system really is freezing (as opposed to being observed to pause when remotely accessed).
How long does the freeze last for? How frequent? Is there a blip in the load when it comes back? Where are you observing these freezes? Is this a dedicated or virtual machine?
For overall trends about your server performance tools like snmp+mrtg, Cacti or Munin can be very useful - they graph CPU usage, memory usage and so on. For command line use
For real-time view just stay logged on your server and follow stuff like
Consider setting up a separate syslog server If you have spare hardware (or a central syslog server already installed), use it! You just configure your server to send out its syslogs and other logs to your syslog server. Sometimes those freezes (if caused by a kernel panic) might happen so that your server cannot write information to disk but it's able to send its last words to the syslog server.
Test your server with memtest86 if you can take your server offline for a night or so, let it run
Sorry, I'm unable to be more helpful than this since you did not actually tell us much about your problem.