Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Occasionally, during random parts of the day, I get a 10 minute period of extreme sluggishness where my requests are taking 50-1000 times longer then they normally do. Note: I am on Apache/2.2.16 (Debian), running PHP 5.3.3

Newrelic shows that the time is not spent in the Database, it's supposedly spent while PHP is executing before the first line of code (according to some traces). At the same time, I see a huge drop in throughput to nearly 1/3 the normal amount.

When I look at the graphs, I can see that CPU, Memory, Disk IO, and CPU waitIO are all at steady levels: No spikes at all. I don't see any error messages in the error log for PHP or the web server during that time. The server has more then enough memory, according to newrelic it's only using about 25%. Total memory is 3.3 GB.

Note: The load average is about .25 on two cores, hence load is fairly low. I typically get about 1000-1500 requests per minute. response times are usually 15ms to 150ms.

here are some of my apache configs:

<IfModule mpm_worker_module>
    StartServers          2
    MinSpareThreads      25
    MaxSpareThreads      75
    ThreadLimit          64
    ThreadsPerChild      25
    MaxClients          550
    MaxRequestsPerChild   0
</IfModule>

 <IfModule mpm_event_module>
     StartServers          2
     MaxClients          550
     MinSpareThreads      25
     MaxSpareThreads      75
     ThreadLimit          64
     ThreadsPerChild      25
     MaxRequestsPerChild   0
 </IfModule>

MaxClients is set that high becuase our average memory per process is very low: about 1-4mb

The only explanation I can think of is that my Host is dropping connectivity or is having some sort of connectivity issue. Which wouldn't surprise me, since this host (rimuhosting) has been less then reliable.

Is there any other possible explanation?

share|improve this question
    
Is your box collocated or physical? Do you see any hints of steal time in top? Do you have means of assessing network latency while this is going on, e.g., run mtr against your host from an external address? –  tink Mar 20 '13 at 19:40
    
It's a physical. I didn't see any steal time in new relic under the cpu chart. What is mtr? (is that trace?) –  Pascal Aschwanden Mar 20 '13 at 22:34
    
Yes, mtr is a slightly smarter traceroute than traceroute. –  tink Mar 20 '13 at 22:49
    
Is your PHP code performing any kind of internal caching, by any chance? Had a similar issue that ended up being due to cache misses. –  Andrew B Mar 20 '13 at 22:53
    
Thanks for the answer, but I'm not doing caching that would increase execution time by such a significant amount. Even if the APC opcode cache was off the performance wouldn't be that sluggish. But I did notice that facebook api calls were taking much longer: avg 7 sec vs normally 250ms, which could also point to connectivity issues. –  Pascal Aschwanden Mar 21 '13 at 0:05

1 Answer 1

Yes, there are some issues to think about when troubleshooting performance, and most of them can be tweaked at /etc/sysctl.conf file.

Apache and PHP are susceptible to a number of resource depletion Denial of Service attacks, notably, SlowLoris, file.fs-max depletion, socket depletion, number of ephemeral open ports depletion.

Check if sysctl -w net.ipv4.ip_local_port_range="1024 8048" has any effect in your rush hour period. That command informs the OS to use from port 1024 to 8048 to respond to requests, and if your server is getting hammered at some point, you could be getting into socket depletion.

Also, run netstat -na | egrep -c TIME_WAIT and netstat -na | egrep -c STAB to watch for socket usage patterns.

Edit: better than those count commands: watch -n1 'cat /proc/net/sockstat'

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.