DDos and hardware to work well with Litespeed

[ASTRAPI]

Hello

Maybe i am under a ddos attack i am not sure and i want to ask if my hardware is ok to add litespeed and if i apy for installation does the stuff help me with this attack to do the correct settings for me?

I own a dedicated Xeon dual core with 4gb ram and 100mbit unshare speed.

I am planning to move to quad core xeon 8gb ram and 1.000mbit as is getting very annoying this high server load.

Is it possible from a stuff to check it first before i buy the new server if i realy need it?

I own a forum with about 75 users per 15 minutes and a shoutbox with ajax refresh rate 7 seconds and top 10 statistics every 30 seconds refreshing.

I need 15 maybe more seconds to aload any page in my forum and from cpanel i can see server load with red mark.

Running this command:

netstat -nt|grep ESTABLISHED|wc

i get this:



And with this command:

netstat -nt|awk '{print $5;}'|awk -F ':' '{print $1;}'|sort|uniq -c|sort -nr|head

i get this:



I am waiting for your answers

I was read many good reviews at Webhostingtalk and i plan to write back for you when all goes well

Thank you

[mistwang]

You should post your server memory usage, I/O wait, CPU utilization etc.

ShoutCast usually causes high load. And what you experiencing sounds like a DB optimization issue.

[ASTRAPI]

You should post your server memory usage, I/O wait, CPU utilization etc.

How can i check this?

With top command from ssh?

It's not shoutcast is shoutbox for chat

Now i restart the server and is working fast for many minutes and then the same problem..

[mistwang]

Yes, from top output.

[Tony]

Originally Posted by ASTRAPI

How can i check this?

With top command from ssh?

It's not shoutcast is shoutbox for chat

Now i restart the server and is working fast for many minutes and then the same problem..

Shoutbox I think is what George meant. They are really bad and really increase load and traffic. A forum with 30 users online might fit on shared hosting account becomes stressing for a dedicated server. The reason is those shoutboxes are generating page views while the user is not actually doing anything.

So lets take your example. 75 users online at 7 second refresh. That will do ~642 page views a minute or about 11 requests/sec. Not a lot really but thats with just 75 users online. That also does not count any of the real traffic of the site. You want to improve loads I guarantee disabling that will make a huge difference on the database and php portion.

[ASTRAPI]

I was disable it and it was the same...

Now i restart the server and is working great and the shoutbox is enable...

I n a few hours that i will have again the problem i will post the top output.

Ok here it is:

2280 mysql 21 6 106m 56m 3704 S 73.5 1.7 116:15.87 mysqld
1621 root 0 -20 0 0 0 D 16.9 0.0 1:18.99 loop0
19804 nobody 20 4 32652 16m 2880 S 3.0 0.5 0:01.61 httpd
20541 root 15 0 0 0 0 S 2.7 0.0 0:01.54 pdflush
20545 root 15 0 0 0 0 S 2.3 0.0 0:01.18 pdflush
19847 nobody 20 4 26232 10m 2848 S 1.3 0.3 0:01.15 httpd
20562 nobody 20 4 28260 12m 2780 S 1.3 0.4 0:00.21 httpd
1622 root 10 -5 0 0 0 D 1.0 0.0 0:07.12 kjournald
20229 nobody 20 4 26316 11m 2844 S 1.0 0.3 0:00.48 httpd
20614 nobody 23 4 25832 10m 2808 S 1.0 0.3 0:00.03 httpd
384 root 10 -5 0 0 0 D 0.7 0.0 0:07.53 kjournald
19596 nobody 20 4 26800 11m 2852 S 0.7 0.4 0:01.73 httpd
19877 nobody 20 4 26308 11m 2844 S 0.7 0.3 0:00.81 httpd
20245 nobody 21 4 30356 14m 2800 S 0.7 0.4 0:00.32 httpd
20276 nobody 19 4 25692 10m 2800 S 0.7 0.3 0:00.32 httpd
20420 nobody 21 4 29296 13m 2788 S 0.7 0.4 0:00.23 httpd
20551 nobody 20 4 25868 10m 2868 S 0.7 0.3 0:00.02 httpd
20555 nobody 20 4 25860 10m 2856 S 0.7 0.3 0:00.02 httpd
20576 nobody 20 4 29348 13m 2776 S 0.7 0.4 0:00.19 httpd
20615 nobody 24 4 25824 10m 2800 S 0.7 0.3 0:00.02 httpd
19571 nobody 19 4 28364 12m 2852 S 0.3 0.4 0:01.71 httpd
19846 nobody 19 4 28292 12m 2844 S 0.3 0.4 0:01.49 httpd
20214 nobody 19 4 26172 10m 2848 S 0.3 0.3 0:00.91 httpd
20241 nobody 20 4 31928 16m 2848 S 0.3 0.5 0:00.54 httpd
20244 nobody 19 4 28840 13m 2844 S 0.3 0.4 0:00.53 httpd
20265 nobody 20 4 32544 16m 2876 S 0.3 0.5 0:00.83 httpd
20603 root 16 0 2328 1100 796 R 0.3 0.0 0:00.02 top
20616 nobody 21 4 24536 8904 2524 R 0.3 0.3 0:00.01 httpd
1 root 15 0 2064 664 572 S 0.0 0.0 0:00.59 init
2 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/0
3 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
5 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/1
6 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/1
7 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/1
8 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/0
9 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/1
10 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khelper
11 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 kthread
15 root 10 -5 0 0 0 S 0.0 0.0 0:00.09 kblockd/0
16 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kblockd/1
17 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 kacpid
88 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/0
89 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/1
92 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khubd
94 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kseriod
162 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 kswapd0
163 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 aio/0
164 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 aio/1
327 root 12 -5 0 0 0 S 0.0 0.0 0:00.00 kpsmoused
357 root 10 -5 0 0 0 S 0.0 0.0 0:00.51 ata/0
358 root 13 -5 0 0 0 S 0.0 0.0 0:00.08 ata/1
359 root 13 -5 0 0 0 S 0.0 0.0 0:00.00 ata_aux
363 root 10 -5 0 0 0 S 0.0 0.0 0:02.02 scsi_eh_0

[ASTRAPI]

And a second one if you want to compare it:

2280 mysql 21 6 126m 72m 3704 S 149.3 2.2 121:12.99 mysqld
1621 root 0 -20 0 0 0 R 11.4 0.0 1:47.02 loop0
20315 nobody 20 4 32024 15m 2876 S 2.3 0.5 0:01.69 httpd
20933 nobody 19 4 30136 14m 2844 S 2.3 0.4 0:00.45 httpd
20987 nobody 20 4 32692 16m 2848 S 2.3 0.5 0:00.51 httpd
20923 nobody 20 4 29076 13m 2840 S 2.0 0.4 0:00.56 httpd
21378 nobody 20 4 31520 15m 2772 S 2.0 0.5 0:00.11 httpd
20968 nobody 19 4 25044 9.8m 2844 S 1.6 0.3 0:00.38 httpd
20997 root 15 0 0 0 0 S 1.6 0.0 0:02.50 pdflush
21392 nobody 19 4 30020 14m 2708 S 1.6 0.4 0:00.05 httpd
384 root 10 -5 0 0 0 S 1.3 0.0 0:09.99 kjournald
21190 nobody 19 4 28300 12m 2844 S 1.3 0.4 0:00.22 httpd
21398 nobody 27 4 28648 12m 2716 S 1.3 0.4 0:00.04 httpd
21401 nobody 29 4 28648 12m 2740 S 1.3 0.4 0:00.04 httpd
19875 nobody 20 4 28336 12m 2844 S 1.0 0.4 0:01.43 httpd
20945 nobody 19 4 28252 12m 2796 S 1.0 0.4 0:00.32 httpd
20964 nobody 19 4 29884 14m 2848 S 1.0 0.4 0:00.90 httpd
20974 nobody 19 4 28252 12m 2836 S 1.0 0.4 0:00.52 httpd
21359 nobody 19 4 29288 13m 2828 S 1.0 0.4 0:00.13 httpd
21402 nobody 29 4 27896 12m 2708 S 1.0 0.4 0:00.03 httpd
21404 nobody 29 4 27892 11m 2712 R 1.0 0.4 0:00.03 httpd
1622 root 12 -5 0 0 0 S 0.7 0.0 0:08.14 kjournald
21189 nobody 19 4 30792 15m 2836 S 0.7 0.5 0:00.28 httpd
21376 nobody 19 4 24456 9372 2760 S 0.7 0.3 0:00.07 httpd
2670 root 29 4 23652 9272 3836 S 0.3 0.3 0:01.68 httpd
20242 nobody 20 4 29308 13m 2848 S 0.3 0.4 0:00.98 httpd
20299 nobody 19 4 29432 14m 3172 S 0.3 0.4 0:00.95 httpd
20873 nobody 19 4 29364 13m 2844 S 0.3 0.4 0:00.67 httpd
20887 nobody 20 4 32972 16m 2796 S 0.3 0.5 0:00.54 httpd
20941 nobody 19 4 30680 15m 2844 S 0.3 0.5 0:00.76 httpd
20952 nobody 19 4 29356 14m 3284 S 0.3 0.4 0:00.42 httpd
20953 nobody 19 4 29248 13m 2796 S 0.3 0.4 0:00.36 httpd
20982 nobody 19 4 30108 14m 2844 S 0.3 0.4 0:00.56 httpd
21184 nobody 19 4 24404 9404 2836 S 0.3 0.3 0:00.13 httpd
21185 nobody 19 4 26132 10m 2844 S 0.3 0.3 0:00.36 httpd
21381 nobody 20 4 29160 13m 2732 S 0.3 0.4 0:00.05 httpd
21384 root 15 0 2328 1096 796 R 0.3 0.0 0:00.01 top
1 root 15 0 2064 664 572 S 0.0 0.0 0:00.59 init
2 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/0
3 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
5 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/1
6 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/1
7 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/1
8 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/0
9 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/1
10 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khelper
11 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kthread
15 root 10 -5 0 0 0 S 0.0 0.0 0:00.12 kblockd/0
16 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kblockd/1
17 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 kacpid
88 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/0
89 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/1

[mistwang]

Looks like your server performance is bounded by mysql, try command

mysqladmin processlist

if a SQL takes too long to process, you need to check the index and optimize the SQL.

[robfrew]

I would also try installing the trial version of Litespeed to see if it can help you.

[ASTRAPI]

From platinum server support they told me that i have 3 Million hits per day.

My server is Dual Xeon with 4gb ram and i am planinning to get a Quad Xeon with 8gb ram as this is the best in my datacenter...