Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

My server has been down most of the day, running top shows several Apache processes (httpd) each one using 70% or more of the CPU, and MySql eating almost all memory.

I have tried rebooting the server, restarting the services and each time the situations goes back to the same.


netstat -n | grep :80 | wc -l

to see the number of connections open to the web server shows around 600 at some points.

That made my think I'm under a DDOS but when I run

netstat -a

There is a tons of connections (more than 200) that look like this:

tcp 0 0 TIME_WAIT
tcp 0 0 TIME_WAIT
tcp 0 0 TIME_WAIT
tcp 0 0 TIME_WAIT
tcp 0 0 TIME_WAIT

Why could be my mail subdomain opening so many HTTP connections?

My mail server is EXIM, when I check "SHOW PROCESSLIST" on MySQL all that I see is bunch of Sleep commands running.

What can I do? I'm running out of ideas, PLEASE help!

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 17:34

This question was marked as an exact duplicate of an existing question.

put iptables for ddos and port scanning attack. you can also use tools like psad or rootkit. I am using my own iptable script which I created for this purpose. Modify the script ,test in teseting server first and then implement. fail2ban is also good tool. you can use it for this purpose. just try and give feedback of current result

share|improve this answer
Check the all mysql queries also.It might be possible the query has some issue and cause the mysql to consume cpu. – Sharad Chhetri Aug 10 '13 at 5:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.