0

Recently my websites appear to be getting hit by something. They slow down and become unresponsive. After I terminal connect to the server, I see that all resources are maxed out, 100% of CPU, Memory, and Swap memory.

This is starting to happen once a week and it continues for several hours and then things return to normal. However, the frequency is increasing and it's starting to really annoy me. I'm enough to be dangerous, but this is not my area of expertise. I basically built this LAMP server on a digital ocean droplet and added Sentora onto it to help make things easier to manage.

So I'm comfortable in linux at the command prompt and making changes, etc. I just don't have the first idea about how I find out what is happening and how to stop it. I assume I am just being hit by some Chinese bot or something, other than just blocking the entire country of China (which I kind of don't mind doing) through IP, how can I find out what's happening and stop it?

Here is a screenshot from my terminal window of htop. I also have fail2ban installed on this server and configured. It helped in the past when I was being hit by bots and malicious people in China and Russia to try to hack FTP, mail, and SSH ports, however, it doesn't seem to be helping with whatever I am being hit with now.

Any help would be greatly appreciated. thanks!

enter image description here

Improve this question
1
  • 1
    Look for individual processes instead of overall resource utilization. See the SQL slow query log & web server logs: is there something different when this happens?
    – Esa Jokinen
    Dec 2, 2017 at 12:28

1 Answer 1

Reset to default
0

First, understand what requests and queries you are processing. Don't just assume that you are getting hit bot requests, that's not the only explanation.

If you like top-like utilities, try apachetop to get the volume of requests right now. Check if they are actual pages of yours, or possibly exploit attempts trying to get at an admin page or vulnerability.

Also mytop. Watch the number of queries, the number that hit the slow threshold, and any patterns.

If the annoyance is getting to be too much, consider switching your platform to a more managed offering where it is someone else's job to run the app and database.

Improve this answer
1
  • Thanks John! Could you provide a bit of explanation on how to use or what to look for when running apachetop and mytop. I just installed mytop and was able to run it. At the top their is "Slow:" and "Slow qps", both currently show as 0.0. However, the server is currently fine. So I guess I should check this when the server is under load. What am I specifically looking for? Re: apachetop, also I launched this. It starts with everything as 0 or 0.0. Again, server is not under load, so I will check this again, when the issue is happening. What should I be looking for here? Thank you!!
    – AmericanNinja
    Dec 3, 2017 at 7:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .