I've a Debian 9 VPS set up with Apache and PHP-FPM. It connects to another VPS to access a common database server VPS via an SSH tunnel. Mostly this works fine.

Running a test for broken links imposes high load on the web server. For the first 350 or so pages, everything runs smoothly. The SSH CPU demand is about 2% and a couple of FPM processes seem to be coping. The database shows related processes, but these quickly change.

But then, for no obvious reason, the CPU for SSH goes up to around 20%. The number of FPM processes tends to increase. The web server is still responding. There are now often sleeping processes on the database server, connected to the web server.

Some while later, the server usually goes into a state where hardly anything is visibly happening. The database server shows the same five processes, usually all sleeping. The web site is extremely sluggish or times out. Yet the SSH CPU is still running at 20% to 30% or more, and the FPM processes are all taking significant CPU. I really don't know what all this CPU is doing - with nothing external to show for it.

While this is going on and the web site is at a stand still, I can still make a new connection to the database and get speedy results from queries. So the tunnel is still usable from a command line.

Throughout all this the database server seems fine, and is responding promptly to requests from other web servers.

What can be happening and why? Is this an FPM problem or an SSH problem?

  • My first instinct that this is an SSH tunnel issue. To me, it looks like a bad idea to use SSH tunnel for this kind of setup. I would use OpenVPN here, so that there wouldn't be TCP-in-TCP tunnel traffic, which causes all kinds of weird effects. – Tero Kilkanen Jul 17 '18 at 19:06
  • 1
    Thanks, Tero. Although this answer says (and gives supporting evidence) that an SSH tunnel does not involve TCP over TCP serverfault.com/a/653748/180974. My understanding of the comment is that SSH forwards data, not TCP packets. There is a big performance difference (against VPN) according to blog.backslasher.net/ssh-openvpn-tunneling.html which would be a concern. – mbrampton Jul 18 '18 at 8:00
  • Oh yes, I should have checked my facts first before writing assuming things... – Tero Kilkanen Jul 18 '18 at 23:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.