—————————————————————-
—
top
—
Will display the processes that are using the maximum processor resources
We can use various options to monitor and control process through top like shift + p, shift + m and k which is used to kill processes. r can be used to renice a process and prioritise a process. In case of high i/o wait we need to check the logs for
high resources using processes.
———
uptime
———
It displays the the time since the server has been up and running, number of users logged in and the load average. Similarly we can use ‘w’.
————
ps -auxwf
————
Will display the process with details like, username, pid, resource usage and child processes. It is very effective in monitoring processes.
We generally use ps -auxwf | grep gzip
ps -auxwf | grep backup
ps -auxwf | grep pkg
For bad processes – ps -auxwf | grep nobody
——————-
Kill and Kill All
——————-
used to kill processes or services that are found to be eating up server resources.
————–
Spamming
————–
To check spamming we can watch for the mail logs using :
tail -f /var/log/exim_mainlog | grep sendmail
tail -f /var/log/exim_mainlog | grep tmp
tail -f /var/log/exim_mainlog | grep public_html
as spamming can be done from a user’s public_html directory using a script or through sendmail. Another way of spamming is using the tmp directory as it is the ‘world writable directory’.
————–
WebServer logs
————–
We can check for customized logs in the WHM under the Server Status section.
We can trace the user responsible for high web server resource usage by the folowing command
tail -f /etc/httpd/logs/access_log | grep mp3
tail -f /etc/httpd/logs/access_log | grep rar
tail -f /etc/httpd/logs/access_log | grep wav etc
tail -f /etc/httpd/logs/access_log | grep 408 can be used to check for DDOS attacks on the server.
——–
mysql
——–
Apart from top and ps, ‘mysqladmin processlist’ can be used to check the mysql processes, users and the type of process/query being run by the user.
Killing a proceess is the first option to control server load, restarting the affected server is another option. Still if the load is high we track down the responsible user and suspend him.(This applies for all servers,i.e,apache, mysql, exim etc.)
—————————————————————-
1. top – check load average, iowait, httpd, mysql, exim etc.
2. P = CPU Usage, M = Memory Usage, K = kill unwanted processes.
3. If load is high, run “deep”.
4. Login to WHM of the server and check apache, cpu/memory, mysql status.
5. If any user found downloading gif images, mp3, etc; suspend that particular user.
iowait is high, someone is backing up their files; run
# ps aux | grep pkg
# ps aux | grep gzip
# ps aux | grep backup
Spamming check-
# tail /var/log/exim_mainlog –f | grep public_html
MySQLdump check-
# ps aux | grep mysqldump
# mysqladmin processlist — mysql status
Bad processes running-
# ps aux | grep nobody
Service restart commands-
#/scripts/restartsrv_mysql
#/scripts/restartsrv_httpd
#/scripts/restartsrv_exim
—————————————————————-
By using a top command you can find out the process which is causing the load on the server. You can use kill or kilall command to kill that process. OR you can run deep command which will kill all the httpd, exim and mysql process. once the server load comes down restart the service which you have killed.
1. Apache :-
Using top command, we will come to know whether httpd service is eating up high resources on server. if so then kill the httpd service and restart it again when load comes to normal.
You can check if any backup is going on, run the following commands:
# ps aux | grep pkg
# ps aux | grep gzip
# ps aux | grep backup
If any backup process is going on, kill that process.
Also Login to WHM and Check for “Apache ststus”, if find anyone downloading mp3,rar,exe,zip files then suspend that account.
the other way to check any download is going on is by using
ps auxw | grep nobody | grep mp3 , jpeg, wmv, mpeg, rar and kill that process.
ALso you can used to check “cpu/memory/Mysql Usage” option from WHM. Here we can find actual CPU and Memory usage for particular domain.
2. Exim Mail :-
Check for spamming by checking the logs for exim
tail -f /var/log/exim_mainlog >> checking for logs and check which email addresses is continuesly scrolling and confirm is it doing spaming,if confirmed then suspend account.
tail -f /var/log/exim_mainlog | grep tmp
Login to whm and select “Manage Mailqueue” to find the email address which is doing spamming.
3. MySQL :-
Use the mysqladmin command as mysqladmin process / mysqladmin status
Also used to check “cpu/memory/Mysql Usage” option from WHM. You can get actual CPU and Memory usage for particular domain.
4. Ftp :-
ps -aux | grep ftp >> used for checking ftp action taken by user like uploading /downloading files
tail -f /var/log/secure
5. ps command :-
Use ps -auxw command ALWAYS to check if there is bad processes running by doing ps aux|grep nobody. You’ll sometimes see bad scripts running as nobody. Normally only httpd, merlange chat, and sometimes proftpd are run as user nobody. so if you find any other process is running as user nobody kill that process.
kill -9 pidofproc
—————————————————————-
Some basic commands to see load average and process running on the server,
1]top :: This command is very useful for system administartion. Basically it gives you summary view of system, including number of users, memory usage, CPU usage and active processes.
Shift+p =>list all processes accourding to maximum CPU usage.
Shift+m=>list all processes accourding to maximum memory usage.
2]w :: This commands gives us information regarding who is logged into server and what processes they are running
w -s , gives you shorter process listing.
3]uptime:: It will also gives us information regarding the number of user logged into server, Current time, time since server is up, load average.
4]ps :: list the current running processes.
ps -aux , gives us information of users, PID, resoure usages like CPU and memory, processes running.
Reasons for increase of load on the server::
Load on server will get increase due to sevral reasons sated below,
1.many httpd processes
2.any user is downloading mp3, exe, zip files
3.email spamming
4.uploading/downloading files via FTP
5.mysql processes and queries run by user
Troubleshooting::
1.If many load increased suddenly, fire “deep” command, which kills httpd, mysql and exim processes.
2. Also Login to WHM and Check for “Apache ststus”, if find anyone downloading mp3,rar,exe,zip files then suspend that account.
3.For spamming, you need to fire following commands,
tail -f /var/log/exim_mainlog | grep public_html
—————————————————————-
1)top
2)w
3)shift+m
4)shift+p
5)tail -f /usr/local/apache/logs/access_log
6)tail -f /usr/local/apache/logs/error_log
7)tail -f /var/log/exim_mainlog
—————————————————————-
1. Check for server load using top command with following options:
Shift p CPU Usage,
Shift m Memory Usage
& check which process is taking load with the help of above two options.
Kill the responsible process using k option.
2. Check for the downloads using
# ps auxw | grep nobody | grep mp3 , jpeg, wmv, mpeg, rar
# ps auxw | grep gzip, backup, fixquota
Suspend the perticular account who is repeatedly downloading the above mentioned files.
3. Check for access & error logs for following options
# tail -f /etc/httpd/logs/access_log | grep 408, zip
# tail -f /etc/httpd/logs/error_log | grep 203
4. Check mail spamming with following commands.
#tail -f /var/log/exim_mainlog | grep sendmail, public_html, tmp
5. Login to WHM of the server and check apache, cpu/memory, mysql status & check for frozen mails in mail queue manager.
6. Check Mysql errors with
# mysqladmin processlist
check the users, command, time & information fields.
7. If you are making changes to httpd.conf then first run # httpd -configtest before restarting httpd to reduce the downtime.
8. Restart the perticular service causing load tomgo hihg with # /scripts/restartsrv_httpd, exim, mysql
