Mayur's BLOG

Q:- How to trace the server load? (Inludes with all application.)


The steps are according to services :-

----------------------------------------------------------------

1. Apache :-

+ top command >> check for many httpd processes

+ Login to WHM >> Check for "Apache ststus",if find anyone downloading mp3,rar,exe,zip files then suspen that account
+ also used to check "cpu/memory/Mysql Usage" option from WHM >> Here we can find actual CPU and Memory usage for particular domain.

----------------------------------------------------------------

2. Mysql :-

+ top command >> check for many httpd processes
+ mysqladmin process / mysqladmin status
+ also used to check "cpu/memory/Mysql Usage" option from WHM >> Here we can find actual CPU and Memory usage for particular domain.

----------------------------------------------------------------

3. Ftp :-

+ ps -aux | grep ftp >> used for checking ftp action taken by user like uploading /downloading files
+ tail -f /var/log/secure

----------------------------------------------------------------

4. SMTP / POP3 /IMAP :-

+ tail -f /var/log/exim_mainlog >> checking for logs and check which email addresses is continuesly scrolling and confirm is it doing spaming,if confirmed then suspend account
+ tail -f /var/log/exim_mainlog | grep public_html >> check for spamming if anybody is using php script for sending mail
+ Login to whm and select "Manage Mailqueue" to find the email address which is doing spamming.


===========================================================================================================================


First of all check the load and if its above safe limits, we have to settle it down. run deep scripts untill you get the messages "no processes found" for mysql, exim and http. check the load again. restart the services by proper restart scripts
s-http, s-mysql, s-exim. Then proceed for investigation.

* top, shift p, check processes taking load and are in plenty.
* if apache
* quickly go to whm and check apache status and do the needful. if theres nothing in apache
check netstat -n|less . it can be http attack.
* if mysql-
do mysqladmin process and look for processes and queries.
* if exim-
go to /var/log/exim_maillog and check the logs for spam.
this can be done by grepping the logs as follows:
tail -f /var/log/exim_mainlog|grep /tmp
tail -f /var/logs/exim_mainlog |grep public_html
tail -f /var/logs/exim_mainlog |grep sendmail
check mail queue
check for frozen mails and delete frozen mails.
* check io wait if its more.
there can be some reasons for this.
* any user may be downloading heavy files- this you can see in the apache status.
* you can see the heavy cpu consuming processes on the server by ps auxw|grep mvi,mgp,mp3,pkgacct,backup,gzip and you can get the processes. check it and kill it as necessary.
* last is check out for bad processes by ps auxw|grep nobody and kill the bad processes. to know more about what is happening behind the process you can check at /proc/procid.==============================================================================================

1> ps aux | grep nobody or gzip /backup /fixquota
2> TOP / shift + p / shift + m / k =kill
3> tail -f /var/log/... | grep ... .avi/.mpg/.rar/.jpg all logs
4> cd /proc/pid ls -alh
5> Apache status/ cpu mysql memory usage form whm
6> netstat -n
7> w
8> Event Viewer log / Task manager for windows
9>tail -f /var/log/exim_mainlog|grep tmp /sendmail /public_html


==============================================================================================

1) top.....to see the process list, then accroding kill the process which is taking load
2) ps -aux
ps -aux | grep gzip, backup, pkg
tail -f /var/log/exim_maillog | grep sendmail, public, tmp
3) w to see whois online
4) kill httpd, mysqld, cppop
5) netstat
6) mysqladmin process :- to see the mysql process
7) /scripts/restartsrv_service name:- to restart the service if it goes down
8) tail -f /etc/httpd/logs/access_log
tail -f /etc/httpd/logs/error_log

or you can manage the serverload using WHM

1) under the server status option you can see the
apache status...
CPU/Mysql usages/memory
service status and you can manage the server
2) SQL services under this option you can see the mysqladmin process

3) restart services:- using this option you can restart the services

==============================================================================================



---
top
---
Will display the processes that are using the maximum processor resources
We can use various options to monitor and control process through top like shift + p, shift + m and k which is used to kill processes. r can be used to renice a process and prioritise a process. In case of high i/o wait we need to check the logs for
high resources using processes.

------
uptime
------
It displays the the time since the server has been up and running, number of users logged in and the load average. Similarly we can use 'w'.

---------
ps -auxwf
---------
Will display the process with details like, username, pid, resource usage and child processes. It is very effective in monitoring processes.
We generally use ps -auxwf | grep gzip
ps -auxwf | grep backup
ps -auxwf | grep pkg
For bad processes - ps -auxwf | grep nobody
ps -aufxw |sort -nr |grep -v 0.0 - Shows which CPU consumming proccesses

----------------
kill and killall

Scenario: Want to kill all processes of particular user, fire the following command:

kill -9 $(pgrep -u username)

Ex: kill -9 $(pgrep -u nobody)

OR

kill -9 `ps -u username -o "pid="`

Ex: kill -9 `ps -u nobody -o "pid="`