1

We just config our website to our new server running on Windows Server 2008.

Our server is quite strong, Xeon quadcore 3.0 and 25GB ram. Running Mysql and Apache

Problem is we are running high on CPU. From taskmanager usually shows 90 -> 100% CPU max in all core. This CPU are all in process httd from Apache.

Running 

netstat -ano | find /c "80"

We found out that the server always busy with around 2200 -> 2700 connections on port 80. Could this be a ddos attack, how could we re-config to optimize our server and block unnecessary requests?

Improve this question
5
  • The first issue is: what does your server do? If it is just serving static content, or very simple pages (for example adding two number passed as parameters), then a 100% might be excessive. If it is crunching a lot of data from the DB, or generating ray-tracing images for your users, then it is not a surprise if it has that heavy load. Also there are configuration issues (http vs. https, user management, and so on) and programming issues (there is an infinite loop somewhere in your code?).... Separate webserver and database, find out what is eating CPU, check if it is working as it should
    – SJuan76
    May 20, 2011 at 8:04
  • We use drupal, before it was running quite normal without this kind of excessive load. Also I do have mod_cache and program cache ON in both drupal and apache. The issue must be somewhere around the server config?
    – DucDigital
    May 20, 2011 at 8:10
  • Have you looked into Apache's logfiles to see what it is actually doing?
    – Sven
    May 20, 2011 at 8:12
  • Ok it was not clear that it was a change in a server already working, by your question I thougt you had just setup a new server.
    – SJuan76
    May 20, 2011 at 8:23
  • Before we were run in a slower server but still suffice, now we move to the new server, first few day is normal, after that there is a new peak. It's really supprise me that 2700 connection can max my CPU. Is it normal on that server?
    – DucDigital
    May 20, 2011 at 8:50

2 Answers 2

Reset to default
0

Why not enable extended server status (restricted to your IP range) for a look at what is connecting and to where.

http://httpd.apache.org/docs/2.0/mod/mod_status.html

And look in your logs.

Improve this answer
3
  • 62 requests currently being processed, 88 idle workers. Range usually from 40 -> 60 all the time.
    – DucDigital
    May 20, 2011 at 8:47
  • Is 2700 connections normal with apache?
    – DucDigital
    May 20, 2011 at 8:48
  • 2700 connections is high, but it depends on what your server does and how popular it is, I presume you have checked the apache error log? Also it is worth adding the %D directive to your apache log format, to log the duration of requests (see httpd.apache.org/docs/2.0/mod/mod_log_config.html)
    – jamespo
    May 23, 2011 at 17:01
0

Whether it is bad or not really depends on your application and specific situation. Typically when you use netstat to count connections you do it like:

netstat -ano | grep ESTABLISHED | find /c "80" | wc -l

otherwise you will count a large number of connections in TIME_WAIT which is usually normal. You can also count SYN connections to check for a SYN flood attack.

You may find your connection numbers to drop significantly by just counting the ESTABLISHED ones. For example, on one of my servers currently at 6 req/sec there are a total of 1000 connections but only 5 currently in the ESTABLISHED state (most are in TIME_WAIT). On another server, however, there are 1000 connections but 500 in the ESTABLISHED state (20 req/sec and I suspect some sort of KeepAlive setting is on here). From those values your numbers don't necessarily look too bad.

You can also use an extended netstat command to count the number of connections each IP address is making to your server:

netstat -an | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

A "normal" number of connections/IP again depends on your application. In my case the average is 5-10 so if I ever see significantly more than that I look into it in more detail.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .