Excesive load due to apache

[braynid]

Hello,

I have a VPS hosted at GoDaddy with CPU 2.80GHz, 512MB of RAM guaranteed and 2 GB bursted running a CentOS.

The thing is that sometimes, almost daily around 20.00 GMT+2 I experience a very high cpu load (as high as 30) that makes the hosted sites unreachable.

Using "ps -axu" I've noticed that apache makes all that load but I can't understand why. It's certainly not from the number of visitors that use the apache in the given moment.

Also in the error logs I've found the following:

[Mon May 14 13:39:30 2007] [error] [client 88.232.118.80] File does not exist: /var/www/html/button.php, referer: http://walpapers.evolink.ro/
[Mon May 14 13:39:30 2007] [error] [client 88.253.3.244] File does not exist: /var/www/html/button.php, referer: http://walpapers.evolink.ro/
[Mon May 14 13:39:30 2007] [error] [client 74.52.183.34] File does not exist: /var/www/html/button.php
[Mon May 14 13:39:30 2007] [error] [client 88.231.161.242] File does not exist: /var/www/html/button.php, referer: http://walpapers.evolink.ro/

Please notice there are up to four requests of the kind per second! Can this be the cause ?

Also I have 'tweaked' the apache configuration as follows:

KeepAliveTimeout 15

<IfModule prefork.c>
StartServers       1
MinSpareServers    1
MaxSpareServers    5
ServerLimit        50
MaxClients        50
MaxRequestsPerChild  4000

Can this be a problem also ?

Thanks.

[objuan]

"(The thing is that sometimes, almost daily around 20.00 GMT+2 I experience a very high cpu load (as high as 30) that makes the hosted sites unreachable.)"

Because this is happening at 20:00 Hours check to see if your have something in your Cron running or maybe webstats so on.

The setting you show for apache should not cause the load. in stead of ps aux this only list the process try top -c this will list the top process using the most resource's

[braynid]

I've checked, crontab is clean. Besides it happens ALMOST daily at that hour. For example today it was ok!

[TheBigPhish]

look at the end of each error message in your log file. You are getting snotted by someone's website (as i browsed to that website, i could now see why) who is looking for a button image file, on YOUR server that it cannot find, and their server keeps looking for it - (look at the referrer line). I would go and blacklist their addresses, so that referrers from that domain / IP block don't get thru, that way you don't have to worry about it.

I would consequently start looking at what they are looking for, and why...did you ever have a button.php file up in service? If you didn't, i would get on go-daddy's ass and ask them how and why you are getting this kind of problem, and ask them if they have any other users with the same issue, or if this is limited to your account. If they have no answers, i would ask them to see if they can do something about limiting traffic from this domain name, as this seems to be the root of all your issues.

[braynid]

The first thing I did was to submit a trouble ticket to GoDaddy but although they answered in a timely manner their response was that the host is unmannaged(as expected).

On the other hand we use a VPS and the path to ALL websites is:

/var/www/vhosts/domain/httpdocs

certainly NOT:

/var/www/html/button.php

I'm going to try and blacklist their address...

[TheBigPhish]

and then i would attempt (futile at best) the hosting service for the offender to say "hey someone over there is raping my apache2 install, wtf". YMMV on that.