michaellunsford Posted October 17, 2008 Share Posted October 17, 2008 How do I find out which website is killing my server? I have 40 of them, running red hat with plesk 8. Link to comment https://forums.phpfreaks.com/topic/128885-solved-some-site-is-crashing-my-server-but-which-one/ Share on other sites More sharing options...
Maq Posted October 17, 2008 Share Posted October 17, 2008 Not sure how helpful this will be but look at the processes running, "ps -ef | more" Link to comment https://forums.phpfreaks.com/topic/128885-solved-some-site-is-crashing-my-server-but-which-one/#findComment-668214 Share on other sites More sharing options...
michaellunsford Posted October 17, 2008 Author Share Posted October 17, 2008 I can watch processes real time with "top" -- problem is I have no idea which site is running them. Link to comment https://forums.phpfreaks.com/topic/128885-solved-some-site-is-crashing-my-server-but-which-one/#findComment-668223 Share on other sites More sharing options...
michaellunsford Posted October 17, 2008 Author Share Posted October 17, 2008 okay, here's how I did it. I rebooted the server, and while it was happy and fresh, I turned off apache and scanned all the logs from today by hand. I found the culprit. a stupid include exploit --- oh, how I HATE hackers. Link to comment https://forums.phpfreaks.com/topic/128885-solved-some-site-is-crashing-my-server-but-which-one/#findComment-668391 Share on other sites More sharing options...
PFMaBiSmAd Posted October 17, 2008 Share Posted October 17, 2008 oh, how I HATE hackers.Or programmers that do not validate ALL external data. Link to comment https://forums.phpfreaks.com/topic/128885-solved-some-site-is-crashing-my-server-but-which-one/#findComment-668397 Share on other sites More sharing options...
michaellunsford Posted October 17, 2008 Author Share Posted October 17, 2008 Yeah, point taken. I just slipped on this one. But, oh what a slip. Link to comment https://forums.phpfreaks.com/topic/128885-solved-some-site-is-crashing-my-server-but-which-one/#findComment-668401 Share on other sites More sharing options...
Maq Posted October 18, 2008 Share Posted October 18, 2008 okay, here's how I did it. I rebooted the server, and while it was happy and fresh, I turned off apache and scanned all the logs from today by hand. I still wonder if there's a quick command to easily figure something like this out... Link to comment https://forums.phpfreaks.com/topic/128885-solved-some-site-is-crashing-my-server-but-which-one/#findComment-668620 Share on other sites More sharing options...
steviewdr Posted October 19, 2008 Share Posted October 19, 2008 Its certainly not easy to find out which site causes an issue. Some things which can help: have each site as a vhost. I.E.: site1.server.com site2.server.com and have each vhost logging to seperate access logs. Things I run and monitor: webalizer for each vhost I have mod_status enabled: http://www.debuntu.org/apache-activity-performance-mod_status I have munin logging and creating graphs of apache. See: http://muninexchange.projects.linpro.no/?search&cid=1&pid=3&phid=123 Even still its quite difficult to track down what script may be affecting the performance of a server. If anyone has any other tips and tricks to monitor or graph which scripts are using up a lot of resources, I would be very interested to hear. -steve Link to comment https://forums.phpfreaks.com/topic/128885-solved-some-site-is-crashing-my-server-but-which-one/#findComment-669185 Share on other sites More sharing options...
tomfmason Posted October 20, 2008 Share Posted October 20, 2008 you should check out my tutorial on preventing rfis - http://phpfreaks.com/tutorial/preventing-remote-file-include-attacks-with-mod-rewrite . suhosin might be something you should look into. you should also inspect all files/dirs on your sever. Link to comment https://forums.phpfreaks.com/topic/128885-solved-some-site-is-crashing-my-server-but-which-one/#findComment-670422 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.