Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running an ecommerce website and it's been running fine for a while now, but lately it keeps on crashing on me. It seems like the RAM gets exhausted on the server and then the server stops responding because RAM is at 99%.

I checked "netstat" through SSH and I see a lot of TIME_WAITED listings but not that many ESTABLISHED listing. I think this is either due to malicious crawling from bots or certain IPs that are attacking my website.

Is there a way I can check any logs to see what/who is actually causing my RAM to get exhausted?

Thank you!

share|improve this question

closed as off-topic by Ward, Jenny D, Andrew Schulman, Jim B, mdpc May 21 '15 at 0:08

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

So after you look at netstat for useless information, you pulled up top so you could see what process is sucking down all the memory, then edited that into the question so people might be able to help without blindly guessing as to what might be causing the problem. – Chris S Sep 9 '11 at 17:22
Where are you getting the 99% figure from? [how are you getting that number?] - what is your environment? What cart software [php based?] If you really were out of RAM then it is not likely you would be able to log in via ssh [no memory available to run the connection!!] I would think that it may be just apache that stops responding. Oh yea - are we dealing with Apache here? – Sean Kimball Sep 9 '11 at 17:32
I can monitor my dedicated server from my hosting and I can see each time the server stops responding the server load RAM usage is at 97%-99%. You are correct when it reaches 97%-99% I can't access SSH; so I end up rebooting from my hosting account. So once the server reboots I can then finally access SSH but at that point whatever was causing my website to stop responding is no longer active; so that's why I was seeing if there are any logs that I can look over to see what would be causing this. Since I can't access SSH once RAM reaches 97%-99% usage. – olimits7 Sep 9 '11 at 18:39

You can use tools like top, memstat to check your machine status and to confirm if it is really the apache process(es) which is eating up your memory.

You can look at the system logs /var/log/messages and /var/log/syslog and apache logs. You may find some useful information there.

Also, you can try to reduce the number of these worker threads if you are spawning many apache processes.

It is not enough to look at the ESTABLISHED connections, you need to have an overall look at the connection in all states.

We may be able to give you a better answer if you provide us with more information.

share|improve this answer
Ok, thank you! What information would you need me to provide you with and I'll see if I can get this for you? – olimits7 Sep 9 '11 at 18:44
You need to provide us with relevant information from the log files or tools suggested. – Khaled Sep 9 '11 at 18:48

You should install denyhosts to block bot from brute-forcing ssh logins

share|improve this answer
How is this related to the question?? – mailq Sep 9 '11 at 18:05
Hmm, I read the "...SSH...TIME_WAITED...attack..." bit to mean that he was seeing a lot of SSH connections. On second look, it seems that it might not be what he was saying, so you have a point. – xofer Sep 9 '11 at 18:25
I'm not sure if brute-forcing ssh logins from bots that is causing this, but hopefully I can find the exact cause of this. – olimits7 Sep 9 '11 at 18:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.