From: "Jette Nielsen" <none@bsd-dk--nerdgirl.dk.lh.bsd-dk.dk> To: <none@bsd-novice--bsd-dk.dk.lh.bsd-dk.dk> Subject: Re: Meget højt cpu load påuser Date: Fri, 10 Dec 2004 19:33:22 +0100
"Anders Søndergaard Jensen" skrev:
> Det kunne være interessant at vide hvad httpd havde så travlt med.
> Hvis du kan fange det rigtige tidspunkt, så prøv at køre en
> 'truss -p 78634 | tee httpd.out'
I dag var den gal igen...
----------------------------------------------------
last pid: 11884; load averages: 1.00, 1.00, 1.00 up 36+04:34:33
18:22:10
59 processes: 2 running, 57 sleeping
CPU states: 100% user, 0.0% nice, 0.0% system, 0.0% interrupt, 0.0%
idle
Mem: 154M Active, 242M Inact, 73M Wired, 15M Cache, 60M Buf, 14M Free
Swap: 512M Total, 512M Free
PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND
7283 www 58 0 17796K 10472K RUN 24.4H 94.97% 94.97% httpd
267 mysql 2 0 52648K 22532K poll 167:31 3.37% 3.37% mysqld
----------------------------------------------------
Jeg prøvede så 'truss -p 7283 | tee httpd.out', men der kom intet output
overhovedet.
For at være sikker prøvede jeg også på PID 267, og den skrev lystigt ....
weird...
Jeg tog så en lsof -p 7283, og det gav følgende:
-------------------------------------------------------
# lsof -p 7283
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 7283 www cwd VDIR 116,131077 1024 873600
/usr/local/www/dk-fritid-dyr-kat.dk/nyhedsgruppen/newsreader
httpd 7283 www rtd VDIR 116,131072 512 2 /
httpd 7283 www txt VREG 116,131077 356511 809357
/usr/local/sbin/httpd
httpd 7283 www txt VREG 116,131077 85940 2598408
/usr/libexec/ld-elf.so.1
httpd 7283 www txt VREG 116,131077 28432 1859245
/usr/lib/libcrypt.so.2
httpd 7283 www txt VREG 116,131077 16420 809200
/usr/local/lib/libmm.so.13
httpd 7283 www txt VREG 116,131077 582928 1859311 /usr/lib/libc.so.4
httpd 7283 www txt VREG 116,131077 9265 809417
/usr/local/libexec/apache/mod_mmap_static.so
httpd 7283 www txt VREG 116,131077 8809 809418
/usr/local/libexec/apache/mod_vhost_alias.so
httpd 7283 www txt VREG 116,131077 6966 809419
/usr/local/libexec/apache/mod_env.so
httpd 7283 www txt VREG 116,131077 8310 809424
/usr/local/libexec/apache/mod_define.so
httpd 7283 www txt VREG 116,131077 16363 809425
/usr/local/libexec/apache/mod_log_config.so
httpd 7283 www txt VREG 116,131077 21277 809434
/usr/local/libexec/apache/mod_mime_magic.so
httpd 7283 www txt VREG 116,131077 13581 809435
/usr/local/libexec/apache/mod_mime.so
httpd 7283 www txt VREG 116,131077 25300 809441
/usr/local/libexec/apache/mod_negotiation.so
httpd 7283 www txt VREG 116,131077 18311 809445
/usr/local/libexec/apache/mod_status.so
httpd 7283 www txt VREG 116,131077 18377 809449
/usr/local/libexec/apache/mod_info.so
httpd 7283 www txt VREG 116,131077 32807 809453
/usr/local/libexec/apache/mod_include.so
httpd 7283 www txt VREG 116,131077 26655 809455
/usr/local/libexec/apache/mod_autoindex.so
httpd 7283 www txt VREG 116,131077 6848 809456
/usr/local/libexec/apache/mod_dir.so
httpd 7283 www txt VREG 116,131077 13686 809457
/usr/local/libexec/apache/mod_cgi.so
httpd 7283 www txt VREG 116,131077 5920 809458
/usr/local/libexec/apache/mod_asis.so
httpd 7283 www txt VREG 116,131077 14625 809461
/usr/local/libexec/apache/mod_imap.so
httpd 7283 www txt VREG 116,131077 7392 809463
/usr/local/libexec/apache/mod_actions.so
httpd 7283 www txt VREG 116,131077 11066 809473
/usr/local/libexec/apache/mod_speling.so
httpd 7283 www txt VREG 116,131077 7457 809476
/usr/local/libexec/apache/mod_userdir.so
httpd 7283 www txt VREG 116,131077 10084 809477
/usr/local/libexec/apache/mod_alias.so
httpd 7283 www txt VREG 116,131077 52119 809478
/usr/local/libexec/apache/mod_rewrite.so
httpd 7283 www txt VREG 116,131077 8796 809479
/usr/local/libexec/apache/mod_access.so
httpd 7283 www txt VREG 116,131077 10756 809480
/usr/local/libexec/apache/mod_auth.so
httpd 7283 www txt VREG 116,131077 7006 809481
/usr/local/libexec/apache/mod_auth_anon.so
httpd 7283 www txt VREG 116,131077 8098 809415
/usr/local/libexec/apache/mod_auth_db.so
httpd 7283 www txt VREG 116,131077 9999 809470
/usr/local/libexec/apache/mod_digest.so
httpd 7283 www txt VREG 116,131077 88530 809471
/usr/local/libexec/apache/libproxy.so
httpd 7283 www txt VREG 116,131077 8336 809482
/usr/local/libexec/apache/mod_cern_meta.so
httpd 7283 www txt VREG 116,131077 8720 809483
/usr/local/libexec/apache/mod_expires.so
httpd 7283 www txt VREG 116,131077 6883 809484
/usr/local/libexec/apache/mod_headers.so
httpd 7283 www txt VREG 116,131077 11833 809485
/usr/local/libexec/apache/mod_usertrack.so
httpd 7283 www txt VREG 116,131077 7340 809487
/usr/local/libexec/apache/mod_unique_id.so
httpd 7283 www txt VREG 116,131077 8990 809488
/usr/local/libexec/apache/mod_setenvif.so
httpd 7283 www txt VREG 116,131077 946977 807589
/usr/local/libexec/apache/libphp4.so
httpd 7283 www txt VREG 116,131077 117024 1859248 /usr/lib/libm.so.2
httpd 7283 www txt VREG 116,131077 190452 809489
/usr/local/libexec/apache/libssl.so
httpd 7283 www txt VREG 116,131077 907507 809614
/usr/local/lib/libssl.so.3
httpd 7283 www txt VREG 116,131077 1121515 809613
/usr/local/lib/libcrypto.so.3
httpd 7283 www txt VREG 116,131077 47043 899653
/usr/local/lib/php/20020429/session.so
httpd 7283 www txt VREG 116,131077 9704 899662
/usr/local/lib/php/20020429/mhash.so
httpd 7283 www txt VREG 116,131077 99339 807982
/usr/local/lib/libmhash.so.2
httpd 7283 www txt VREG 116,131077 12563 899666
/usr/local/lib/php/20020429/gettext.so
httpd 7283 www txt VREG 116,131077 38925 806937
/usr/local/lib/libintl.so.6
httpd 7283 www txt VREG 116,131077 1001187 806627
/usr/local/lib/libiconv.so.3
httpd 7283 www txt VREG 116,131077 1607785 899670
/usr/local/lib/php/20020429/mbstring.so
httpd 7283 www txt VREG 116,131077 81580 899774
/usr/local/lib/php/20020429/pcre.so
httpd 7283 www txt VREG 116,131077 66071 899782
/usr/local/lib/php/20020429/openssl.so
httpd 7283 www txt VREG 116,131077 26914 900632
/usr/local/lib/php/20020429/calendar.so
httpd 7283 www txt VREG 116,131077 11707 900656
/usr/local/lib/php/20020429/ctype.so
httpd 7283 www txt VREG 116,131077 36148 900660
/usr/local/lib/php/20020429/ftp.so
httpd 7283 www txt VREG 116,131077 317574 900665
/usr/local/lib/php/20020429/gd.so
httpd 7283 www txt VREG 116,131077 263388 806741
/usr/local/lib/libt1.so.5
httpd 7283 www txt VREG 116,131077 465758 809203
/usr/local/lib/libfreetype.so.9
httpd 7283 www txt VREG 116,131077 885070 2644435
/usr/X11R6/lib/libX11.so.6
httpd 7283 www txt VREG 116,131077 61484 2644546
/usr/X11R6/lib/libXpm.so.4
httpd 7283 www txt VREG 116,131077 141928 806595
/usr/local/lib/libpng.so.5
httpd 7283 www txt VREG 116,131077 52108 1859509 /usr/lib/libz.so.2
httpd 7283 www txt VREG 116,131077 135701 806602
/usr/local/lib/libjpeg.so.9
httpd 7283 www txt VREG 116,131077 5243 2644433
/usr/X11R6/lib/libXThrStub.so.6
httpd 7283 www txt VREG 116,131077 62689 2644475
/usr/X11R6/lib/libXext.so.6
httpd 7283 www txt VREG 116,131077 81179 900683
/usr/local/lib/php/20020429/ming.so
httpd 7283 www txt VREG 116,131077 201400 810047
/usr/local/lib/libming.so.3
httpd 7283 www txt VREG 116,131077 45343 900687
/usr/local/lib/php/20020429/mysql.so
httpd 7283 www txt VREG 116,131077 155797 806726
/usr/local/lib/mysql/libmysqlclient.so.12
httpd 7283 www txt VREG 116,131077 14891 900691
/usr/local/lib/php/20020429/overload.so
httpd 7283 www txt VREG 116,131077 75479 900695
/usr/local/lib/php/20020429/pdf.so
httpd 7283 www txt VREG 116,131077 1149139 809281
/usr/local/lib/libpdf.so.7
httpd 7283 www txt VREG 116,131077 19845 900699
/usr/local/lib/php/20020429/posix.so
httpd 7283 www txt VREG 116,131077 14022 900703
/usr/local/lib/php/20020429/tokenizer.so
httpd 7283 www txt VREG 116,131077 31277 900707
/usr/local/lib/php/20020429/xml.so
httpd 7283 www txt VREG 116,131077 129912 806743
/usr/local/lib/libexpat.so.5
httpd 7283 www txt VREG 116,131077 10251 900711
/usr/local/lib/php/20020429/zip.so
httpd 7283 www txt VREG 116,131077 22211 808760
/usr/local/lib/libzzip.so.10
httpd 7283 www txt VREG 116,131077 26918 900715
/usr/local/lib/php/20020429/zlib.so
httpd 7283 www 0r VCHR 2,2 0t0 21143 /dev/null
httpd 7283 www 1w VCHR 2,2 0t0 21143 /dev/null
httpd 7283 www 2w VREG 116,131076 2017067 819380
/var/log/httpd-error.log
httpd 7283 www 3u VREG 116,131076 0 44309
/var/run/httpd.mm.7277.sem
httpd 7283 www 4u IPv4 0t0 TCP no PCB,
CANTSENDMORE, CANTRCVMORE
httpd 7283 www 5u IPv4 0t0 TCP no PCB,
CANTSENDMORE, CANTRCVMORE
httpd 7283 www 15w VREG 116,131076 2017067 819380
/var/log/httpd-error.log
httpd 7283 www 16w VREG 116,131077 22938 830541
/usr/local/www/logs/secure.nerdgirl.dk-error_log
httpd 7283 www 17w VREG 116,131077 16148 831783
/usr/local/www/logs/eshirts.dk-error_log
httpd 7283 www 18w VREG 116,131077 579431 831777
/usr/local/www/logs/dk-fritid-dyr-kat.dk-error_log
httpd 7283 www 19w VREG 116,131077 1736 831766
/usr/local/www/logs/food.nerdgirl.dk-error_log
httpd 7283 www 20w VREG 116,131077 441000 829120
/usr/local/www/logs/www.nerdgirl.dk-error_log
httpd 7283 www 21u IPv4 0xda00a8c0 0t0 TCP *:https (LISTEN)
httpd 7283 www 22u IPv4 0xda004140 0t0 TCP *:http (LISTEN)
httpd 7283 www 23w VREG 116,131076 301543 819350
/var/log/ssl_engine_log
httpd 7283 www 24w VREG 116,131076 0 44311
/var/run/ssl_mutex.7277
httpd 7283 www 25w VREG 116,131076 2584 819361
/var/log/httpd-access.log
httpd 7283 www 26w VREG 116,131077 27948 830543
/usr/local/www/logs/secure.nerdgirl.dk-access_log
httpd 7283 www 27w VREG 116,131076 29621 819369
/var/log/ssl_request_log
httpd 7283 www 28w VREG 116,131077 271941 831784
/usr/local/www/logs/eshirts.dk-access_log
httpd 7283 www 29w VREG 116,131077 43643656 831782
/usr/local/www/logs/dk-fritid-dyr-kat.dk-access_log
httpd 7283 www 30w VREG 116,131077 196755 831767
/usr/local/www/logs/food.nerdgirl.dk-access_log
httpd 7283 www 31w VREG 116,131077 69296 829125
/usr/local/www/logs/www.nerdgirl.dk-access_log
httpd 7283 www 32w VREG 116,131076 0 44314
/var/run/httpd.lock.7278
httpd 7283 www 33w VREG 116,131076 0 44314
/var/run/httpd.lock.7278
httpd 7283 www 34w VREG 116,131076 0 44311
/var/run/ssl_mutex.7277
> Men de angreb du er udsat for snylter på din båndbredde, så du
> skulle måske ellere søge at minimere impact på din webserver.
> Der er et gammelt forslag her:
> http://seclists.org/lists/incidents/2001/Sep/0360.html
> som jeg bedre kan lide.
Tak, det prøver jeg :-)
/Jette
This archive was generated by hypermail 2b30 : Wed 15 Nov 2006 - 18:25:10 CET