|
see whats up with that user and their process.
Best way to see if your server is getting ddos is:
netstat -ntu | grep SYN_RECV - to see how many incoming syns you have
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr
to show who is connected and how many times.
Also the live reports in litespeed can show you exactly whats going on and the who and where.
Id see whats up with that user you have there, they are either getting some ddos or vampire attack or just a simple http get flood.
The problems with the vamp and http attacks even with litespeed is that it uses php and sql each time a bot hits the page. But with php suexec it can prevent that from taking down the entire server
|