Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.


I am using Linux CentOS 5.8 VPS. But my site is so slow in last two days. When i cehcked in server's web control panel; RAM usage is 99-100 %. But when i write "top" command; there is any usage on RAM. When i write

netstat -ntu | awk '{print $5}' | awk '{sub("::ffff:","");print}' | cut -f1 -d ':' | sort | uniq -c | sort -n | grep -v -e server -e Address -e 127.0.0.1 -e 0.0.0.0

Its giving lists of which IPs still connect. Result is here:

  1 131.253.41.xxx
  1 178.154.255.xxx
  1 188.57.200.xxx
  1 207.46.199.xxx
  2 77.92.139.xxx
  2 88.225.27.xxx
  4 95.0.24.xxx
  5 65.55.215.xxx
  6 174.137.191.xxx
  6 193.254.229.xxx
  6 88.251.71.xxx
 10 95.65.159.xxx
 13 212.57.14.xxx
 55 85.145.xxx.xxx
330 176.53.xxx.xxx

Maybe you think that; Last IP's 330 requests and 55 requests are a DDos attack. I blocked 55 request's IP. But last IP is my server's IP.

So how can i solve this RAm usage problem. Thanks and sorry for my bad English.

EDIT: free-m result

              total       used       free     shared    buffers     cached
Mem:          2048       1949         98          0          0          0
-/+ buffers/cache:       1949         98
Swap:            0          0          0

ps auxw | egrep '(apache|httpd)' result

root      3239  0.0  0.7  23744 16360 ?        S    Sep13   2:48 Xvnc :1 -desktop server.example.com:1 (root) -httpd /usr/share/vnc/classes -auth /root/.Xauthority -geometry 1024x768 -depth 16 -rfbwait 30000 -rfbauth /root/.vnc/passwd -rfbport 5901 -pn
root     12245  0.1  0.5  40500 12064 ?        Ss   15:00   0:04 /usr/bin/php /var/www/vhosts/example.com/httpdocs/directory/sagla/cron_page_u.php
root     13872  2.5  1.2  55552 27140 ?        Ss   15:10   1:35 /usr/bin/php /var/www/vhosts/example.com/httpdocs/directory/feed/cron_page_m.php
apache   19791  0.0  0.4 116816  8844 ?        S    15:53   0:00 /usr/sbin/httpd
apache   20120  0.0  0.4 116816  8844 ?        S    15:54   0:00 /usr/sbin/httpd
apache   20277  0.0  0.4 116816  8832 ?        S    15:57   0:00 /usr/sbin/httpd
apache   20369  0.0  0.4 116816  8820 ?        S    16:00   0:00 /usr/sbin/httpd
apache   20408  0.0  0.4 116816  8844 ?        S    16:01   0:00 /usr/sbin/httpd
root     22471  0.0  0.0   3108   800 pts/0    S+   16:12   0:00 egrep (apache|httpd)
root     24264  0.3  0.6  41708 13020 ?        Ss   08:50   1:27 /usr/bin/php /var/www/vhosts/example.com/httpdocs/directory/sagla/cron_page_1.php
root     25768  0.3  0.6  41452 12888 ?        Ss   12:50   0:37 /usr/bin/php /var/www/vhosts/example.com/httpdocs/directory/sagla/cron_page_1.php
root     27815  0.0  0.7 116544 16252 ?        Ss   12:56   0:03 /usr/sbin/httpd
apache   27817  0.0  0.2  23052  4696 ?        S    12:56   0:06 /usr/sbin/httpd
share|improve this question
1  
Can you show output of "free -m" and "ps auxw | egrep '(apache|httpd)'"? –  0xFF Dec 26 '12 at 13:01
    
i edited for that outputs. –  pheaselegen Dec 26 '12 at 13:13
    
It appears your control panel is wrong. According to your free -m output there is still 844MB RAM free. –  Oldskool Dec 26 '12 at 13:14
    
But i added this 'free -m' output when usage 60%. –  pheaselegen Dec 26 '12 at 13:18
    
@pheaselegen: Do you have any monitoring of this server? Looking at memory usage graph might be helpful. You can also check logfiles of the system and Apache. Logwatch can be useful here, it should be installed by default. –  0xFF Dec 26 '12 at 14:05

1 Answer 1

Since you now have 844Mb free, there is no more RAM problem.

If the problem occurs again, you can do the following : Write down the output of free -m and the apache server status before and after restarting apache.

It will allow you to be sure apache is getting all the ram.

share|improve this answer
    
Ok thanks. What about in netstat output my server ip's 330 request? –  pheaselegen Dec 26 '12 at 13:26
    
@pheaselegen: It's hard to say because we don't know how the websites on your server are designed and what they are doing. Maybe they are badly designed and written... or maybe not. –  0xFF Dec 26 '12 at 14:03
    
330 request can come from a very wide variety of reasons, including : Local indexer/crawler, mod_proxy usage on public ip, monitoring software, ddos ... –  coincoin Dec 26 '12 at 14:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.