Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My website was running fine until yesterday with load averages under 1. Suddenly, yesterday it started behaving badly. I was getting load averages to up to 50.

I haven't changed anything in the server nor in the website and the number of users using the website are still the same as the days before. Here is a screenshot of the top command:

enter image description here

I don't even know where to start to see what is going wrong. The virtual memory of the php processes seem very high tome, but again, it's strange that the days before they seemed to be fine. Or perhaps they weren't and I was completely unaware of it.

What could the cause of the problem be and how would I go about troubleshooting it?

share|improve this question
pornbust O rly? – MDMarra May 29 '12 at 20:09
If memory was an issue, you wouldn't have 200MB free. The issue is what's consuming the CPU, and it looks like it's PHP and Mysqld. – David Schwartz May 29 '12 at 20:40
First and foremost make sure that your version of php5-cgi is up to date. There are exploits in the wild that could take over recently unpatched servers. – Jodie C May 30 '12 at 0:09

The screencap seems to show a number of php processes, which suggests that you are running php under apache2 as a cgi-script (rather then the php-script module) or that you have standalone processes that are running as php command line, or php interpretor.

The associated mysqld CPU, suggests that they are all doing something MySQL related (or that could be a co-incidence)

That those php are not running as the apache user, suggests that you would need to provide some more information about what those processes are, and why they might suddenly use more resources.

if you want to get some more information about the php process, I use something like this as a one-liner to dump some pid info...

first select a pid number from the top outout, for example 8371 from your output, in this example I am just showing some values from a sleep 10000 that i did as a test...

# pid=17837; { cat /proc/${pid}/{cmdline,environ} && ls -l /proc/${pid}/{cwd,exe}; } | tr '\0' '\n'; 
SSH_CLIENT= 55069 22
LESSOPEN=|/usr/bin/ %s
lrwxrwxrwx 1 userXXX users 0 May 29 13:11 /proc/17837/cwd -> /home/userXXX
lrwxrwxrwx 1 userXXX users 0 May 29 13:12 /proc/17837/exe -> /bin/sleep

(there are obviously loads of ways to see what the php invocation was. this was just a quick off my head example)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.