michaellunsford Posted October 17, 2008 Share Posted October 17, 2008 How do I find out which website is killing my server? I have 40 of them, running red hat with plesk 8. Quote Link to comment Share on other sites More sharing options...
Maq Posted October 17, 2008 Share Posted October 17, 2008 Not sure how helpful this will be but look at the processes running, "ps -ef | more" Quote Link to comment Share on other sites More sharing options...
michaellunsford Posted October 17, 2008 Author Share Posted October 17, 2008 I can watch processes real time with "top" -- problem is I have no idea which site is running them. Quote Link to comment Share on other sites More sharing options...
michaellunsford Posted October 17, 2008 Author Share Posted October 17, 2008 okay, here's how I did it. I rebooted the server, and while it was happy and fresh, I turned off apache and scanned all the logs from today by hand. I found the culprit. a stupid include exploit --- oh, how I HATE hackers. Quote Link to comment Share on other sites More sharing options...
PFMaBiSmAd Posted October 17, 2008 Share Posted October 17, 2008 oh, how I HATE hackers.Or programmers that do not validate ALL external data. Quote Link to comment Share on other sites More sharing options...
michaellunsford Posted October 17, 2008 Author Share Posted October 17, 2008 Yeah, point taken. I just slipped on this one. But, oh what a slip. Quote Link to comment Share on other sites More sharing options...
Maq Posted October 18, 2008 Share Posted October 18, 2008 okay, here's how I did it. I rebooted the server, and while it was happy and fresh, I turned off apache and scanned all the logs from today by hand. I still wonder if there's a quick command to easily figure something like this out... Quote Link to comment Share on other sites More sharing options...
steviewdr Posted October 19, 2008 Share Posted October 19, 2008 Its certainly not easy to find out which site causes an issue. Some things which can help: have each site as a vhost. I.E.: site1.server.com site2.server.com and have each vhost logging to seperate access logs. Things I run and monitor: webalizer for each vhost I have mod_status enabled: http://www.debuntu.org/apache-activity-performance-mod_status I have munin logging and creating graphs of apache. See: http://muninexchange.projects.linpro.no/?search&cid=1&pid=3&phid=123 Even still its quite difficult to track down what script may be affecting the performance of a server. If anyone has any other tips and tricks to monitor or graph which scripts are using up a lot of resources, I would be very interested to hear. -steve Quote Link to comment Share on other sites More sharing options...
tomfmason Posted October 20, 2008 Share Posted October 20, 2008 you should check out my tutorial on preventing rfis - http://phpfreaks.com/tutorial/preventing-remote-file-include-attacks-with-mod-rewrite . suhosin might be something you should look into. you should also inspect all files/dirs on your sever. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.