1

I rented a VPS a month ago, which I use to run a couple of web services behind a reverse proxy (JIRA, Confluence and gitlab), and I'm basically the only user of these services.

During this month everything has been running smoothly, however my VPS was suspended yesterday at around 3am. The following morning I saw an email from the company saying that it had been suspended due to a high load average, which reached somewhere around 14 or so. Obviously something had gone very wrong, but I'm not able to figure out what exactly caused that huge spike, especially given that I wasn't even using the server at that point in time, and I hadn't done any changes to the setup in the previous days.

I would appreciate it if you could share any tips or suggestions as to what may have caused this, or how it can be figured out. I checked apache's access logs but didn't see anything particularly strange there...

Mario.

Update:

My issue seems to have to do with about 50 apache2 processes that were suddenly spawned around the same time:

www-data 11756 0.0 0.2 490440 17184 ? S 03:34 0:00 /usr/sbin/apache2 -k start
www-data 11756 0.0 0.2 490440 17184 ? S 03:34 0:00 /usr/sbin/apache2 -k start
www-data 11756 0.0 0.2 490440 17184 ? S 03:34 0:00 /usr/sbin/apache2 -k start
www-data 11756 0.0 0.2 490440 17184 ? S 03:34 0:00 /usr/sbin/apache2 -k start
www-data 11756 0.0 0.2 490440 17184 ? S 03:34 0:00 /usr/sbin/apache2 -k start
www-data 11756 0.0 0.2 490440 17184 ? S 03:34 0:00 /usr/sbin/apache2 -k start
...
  • The apache logs probably hold significant data about the 50 subprocesses that took down your vps – Bruno9779 Mar 1 '17 at 13:17
  • If your virt isn't scaled to run 50 httpds then perhaps limit the number of forks (or threads?) apache is allowed to create via MaxRequestWorkers (or as appropriate for threads?) – thrig Mar 1 '17 at 16:26
  • I've done this, thanks thrig. However I'm more worried about the underlaying reason as to why apache attempted to spawn so many threads. Looking through the logs, it looks like I've consistently been getting lots of POST /xmlrpc.php requests. Googling a bit, it seems like this may be a well-known Wordpress attack. – mario Mar 2 '17 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.