Sorry that I cannot provide very detail information, but only symtoms ...
It's a CentOS + Apache + MySQL + PHP web app. In recent weeks, roughly during 12:05am to 12:50am, the app is timeout and returns nothing to the browser. We looked into the apache log, firewall log, top cpu and memory usage, and did not see anything special. The apache log shows traffic increased not more than 200%, compare with normal period.
How should we proceed and further diagnostic this issue?
netstat shows roughly 300 active
close_wait coming from 2 IP addresses during the busy period. Is there a way to minimize the impact from individual IPs?