Hi,
I’ve got a server with webmin and virtualmin set up. It all works pretty good. “Worked” I should say, as yesterday the load started to ascend and ascend, up to a level where all (5) sites on the server stopped responding.
I had been working on a particular site yesterday, upgrade a joomla component to a recent version. Some things went wrong and I had to do it manually. When afterwards, I saw the loads get higher and higher, I thought it might have to do with that. I disabled access to the component, by getting rid of menu items to it but to no avail.
It has to do with that particular site though. If in Joomla, I put the site ‘offline’ than that doesn’t help, but if I disable that ‘server’ in virtualmin, then down goes my load to normal levels again.
So I checked with ‘top’, but didn’t see anything really weird, apart from a lot of connections to apache. But if something doesn’t respond, than that seems normal, no? Restarting mysql and apache2 does help, for a minute or two, then it all goes back up again.
Normally, the load on the server is around 1 or 2, now when it goes sky high it does go sky high: around 50.
I checked netstat, and it’s quite a list, but it doesn’t look like an attack from one point at least.
So, in other words, it has something to do with site “A”, although other sites on the same server use mysql and php as well, there’s even another joomla site on the server.
How do I know what exactly is bothering it? I didn’t see anything really weird in the apache error log files either.
I’ll attach the netstat output.
What strikes me as odd is that when the site id set to offline in Joomla, it still causes the high load. Only disabling it in Virtualmin really gets the load to normal levels. So to me it seems that something is trying to connect to site A so desperately that even when it’s closed down by Joomla it still causes the server to ge beserk.
The stats (webalizer) show no extra traffic since yesterday at all.
Anyway, any hints appreciated as a ‘disabled’ site isn’t really good for business, is it?
Thanks!