Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My Ubuntu 11.04 server on the internet has some strange behavior since a few days. It runs perfectly fine with some Java web applications. Then, suddenly it does not accept connections anymore. When I try to ssh or to http-connect my server I get no response, until I get timeout. But ping works perfectly. nmap also works:

Starting Nmap 5.21 ( http://nmap.org ) at 2011-08-29 10:52 CEST
Nmap scan report for ...
Host is up (0.020s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
53/tcp   open  domain
443/tcp  open  https
3000/tcp open  ppp
3128/tcp open  squid-http

After reboot, everything works again for some hours.

What could this be? Or how to analyse this problem?

share|improve this question
    
DoS? I would say too many open files (or filehandles). But you should find indication in the system log... –  mailq Aug 29 '11 at 9:15
    
Check if you have "Too many open files" error in /var/log/messages. –  quanta Aug 29 '11 at 9:27

3 Answers 3

up vote 3 down vote accepted

This really does look like you are running out of memory, with no swap on the system. If a linux system runs out of memory, it cannot accept TCP connections anymore because the connection needs memory to be established. ICMP might not need anything since there is not state to maintain.

Check your memory settings everywhere, and make sure you do not allocate more than 70% of the total memory to the JVM (-Xms and -Xmx options).

Activate a swap if not yet done, you can create a basic swap file somewhere on the disk:

dd if=/dev/zero of=/mnt/swapfile bs=1M count=10240
mkswap /mnt/swapfile
swapon /mnt/swapfile

If after that your system hangs again, it's time for some low level monitoring.

share|improve this answer

-Xmx (max heap size) is not all memory allocated for the jvm, another sizable amount is allocated for PermSize (-XX:MaxPermSize) and some more for internal usage. Use top or ps to find out how much your jvm is using and leave room for os+buffers (1Gb plus 150k per concurrent connection is a good start).

share|improve this answer

You should look at your Fail2ban service, I've face the same problem with a hosted linux box, and that came from the fail2ban pre-installed config file.

Or, it could be a DoS as said mailq.

share|improve this answer
    
Fail2ban is an assumption Witek did not mention with any word. –  mailq Aug 29 '11 at 10:45
    
Of course he didn't, but he didn't mention that his server provider has provided him the linux box or if he has installed itself. I'm sorry, but, I've not all informations, so I try to help with my own experience. –  Dr I Aug 31 '11 at 7:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.