DDos and hardware to work well with Litespeed

Discussion in 'Install/Configuration' started by ASTRAPI, Sep 8, 2009.

  1. ASTRAPI

    ASTRAPI New Member

    Hello

    Maybe i am under a ddos attack i am not sure and i want to ask if my hardware is ok to add litespeed and if i apy for installation does the stuff help me with this attack to do the correct settings for me?

    I own a dedicated Xeon dual core with 4gb ram and 100mbit unshare speed.

    I am planning to move to quad core xeon 8gb ram and 1.000mbit as is getting very annoying this high server load.

    Is it possible from a stuff to check it first before i buy the new server if i realy need it?

    I own a forum with about 75 users per 15 minutes and a shoutbox with ajax refresh rate 7 seconds and top 10 statistics every 30 seconds refreshing.

    I need 15 maybe more seconds to aload any page in my forum and from cpanel i can see server load with red mark.

    Running this command:

    netstat -nt|grep ESTABLISHED|wc

    i get this:

    [​IMG]

    And with this command:

    netstat -nt|awk '{print $5;}'|awk -F ':' '{print $1;}'|sort|uniq -c|sort -nr|head

    i get this:

    [​IMG]

    I am waiting for your answers :)

    I was read many good reviews at Webhostingtalk and i plan to write back for you when all goes well :)

    Thank you
  2. mistwang

    mistwang LiteSpeed Staff

    You should post your server memory usage, I/O wait, CPU utilization etc.

    ShoutCast usually causes high load. And what you experiencing sounds like a DB optimization issue.
  3. ASTRAPI

    ASTRAPI New Member

    How can i check this?

    With top command from ssh?

    It's not shoutcast is shoutbox for chat :)

    Now i restart the server and is working fast for many minutes and then the same problem..
    Last edited: Sep 8, 2009
  4. mistwang

    mistwang LiteSpeed Staff

    Yes, from top output.
  5. Tony

    Tony Member


    Shoutbox I think is what George meant. They are really bad and really increase load and traffic. A forum with 30 users online might fit on shared hosting account becomes stressing for a dedicated server. The reason is those shoutboxes are generating page views while the user is not actually doing anything.

    So lets take your example. 75 users online at 7 second refresh. That will do ~642 page views a minute or about 11 requests/sec. Not a lot really but thats with just 75 users online. That also does not count any of the real traffic of the site. You want to improve loads I guarantee disabling that will make a huge difference on the database and php portion.
  6. ASTRAPI

    ASTRAPI New Member

    I was disable it and it was the same...

    Now i restart the server and is working great and the shoutbox is enable...

    I n a few hours that i will have again the problem i will post the top output.

    Ok here it is:

    2280 mysql 21 6 106m 56m 3704 S 73.5 1.7 116:15.87 mysqld
    1621 root 0 -20 0 0 0 D 16.9 0.0 1:18.99 loop0
    19804 nobody 20 4 32652 16m 2880 S 3.0 0.5 0:01.61 httpd
    20541 root 15 0 0 0 0 S 2.7 0.0 0:01.54 pdflush
    20545 root 15 0 0 0 0 S 2.3 0.0 0:01.18 pdflush
    19847 nobody 20 4 26232 10m 2848 S 1.3 0.3 0:01.15 httpd
    20562 nobody 20 4 28260 12m 2780 S 1.3 0.4 0:00.21 httpd
    1622 root 10 -5 0 0 0 D 1.0 0.0 0:07.12 kjournald
    20229 nobody 20 4 26316 11m 2844 S 1.0 0.3 0:00.48 httpd
    20614 nobody 23 4 25832 10m 2808 S 1.0 0.3 0:00.03 httpd
    384 root 10 -5 0 0 0 D 0.7 0.0 0:07.53 kjournald
    19596 nobody 20 4 26800 11m 2852 S 0.7 0.4 0:01.73 httpd
    19877 nobody 20 4 26308 11m 2844 S 0.7 0.3 0:00.81 httpd
    20245 nobody 21 4 30356 14m 2800 S 0.7 0.4 0:00.32 httpd
    20276 nobody 19 4 25692 10m 2800 S 0.7 0.3 0:00.32 httpd
    20420 nobody 21 4 29296 13m 2788 S 0.7 0.4 0:00.23 httpd
    20551 nobody 20 4 25868 10m 2868 S 0.7 0.3 0:00.02 httpd
    20555 nobody 20 4 25860 10m 2856 S 0.7 0.3 0:00.02 httpd
    20576 nobody 20 4 29348 13m 2776 S 0.7 0.4 0:00.19 httpd
    20615 nobody 24 4 25824 10m 2800 S 0.7 0.3 0:00.02 httpd
    19571 nobody 19 4 28364 12m 2852 S 0.3 0.4 0:01.71 httpd
    19846 nobody 19 4 28292 12m 2844 S 0.3 0.4 0:01.49 httpd
    20214 nobody 19 4 26172 10m 2848 S 0.3 0.3 0:00.91 httpd
    20241 nobody 20 4 31928 16m 2848 S 0.3 0.5 0:00.54 httpd
    20244 nobody 19 4 28840 13m 2844 S 0.3 0.4 0:00.53 httpd
    20265 nobody 20 4 32544 16m 2876 S 0.3 0.5 0:00.83 httpd
    20603 root 16 0 2328 1100 796 R 0.3 0.0 0:00.02 top
    20616 nobody 21 4 24536 8904 2524 R 0.3 0.3 0:00.01 httpd
    1 root 15 0 2064 664 572 S 0.0 0.0 0:00.59 init
    2 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/0
    3 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
    4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
    5 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/1
    6 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/1
    7 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/1
    8 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/0
    9 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/1
    10 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khelper
    11 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 kthread
    15 root 10 -5 0 0 0 S 0.0 0.0 0:00.09 kblockd/0
    16 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kblockd/1
    17 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 kacpid
    88 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/0
    89 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/1
    92 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khubd
    94 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kseriod
    162 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 kswapd0
    163 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 aio/0
    164 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 aio/1
    327 root 12 -5 0 0 0 S 0.0 0.0 0:00.00 kpsmoused
    357 root 10 -5 0 0 0 S 0.0 0.0 0:00.51 ata/0
    358 root 13 -5 0 0 0 S 0.0 0.0 0:00.08 ata/1
    359 root 13 -5 0 0 0 S 0.0 0.0 0:00.00 ata_aux
    363 root 10 -5 0 0 0 S 0.0 0.0 0:02.02 scsi_eh_0
    Last edited: Sep 8, 2009
  7. ASTRAPI

    ASTRAPI New Member

    And a second one if you want to compare it:

    2280 mysql 21 6 126m 72m 3704 S 149.3 2.2 121:12.99 mysqld
    1621 root 0 -20 0 0 0 R 11.4 0.0 1:47.02 loop0
    20315 nobody 20 4 32024 15m 2876 S 2.3 0.5 0:01.69 httpd
    20933 nobody 19 4 30136 14m 2844 S 2.3 0.4 0:00.45 httpd
    20987 nobody 20 4 32692 16m 2848 S 2.3 0.5 0:00.51 httpd
    20923 nobody 20 4 29076 13m 2840 S 2.0 0.4 0:00.56 httpd
    21378 nobody 20 4 31520 15m 2772 S 2.0 0.5 0:00.11 httpd
    20968 nobody 19 4 25044 9.8m 2844 S 1.6 0.3 0:00.38 httpd
    20997 root 15 0 0 0 0 S 1.6 0.0 0:02.50 pdflush
    21392 nobody 19 4 30020 14m 2708 S 1.6 0.4 0:00.05 httpd
    384 root 10 -5 0 0 0 S 1.3 0.0 0:09.99 kjournald
    21190 nobody 19 4 28300 12m 2844 S 1.3 0.4 0:00.22 httpd
    21398 nobody 27 4 28648 12m 2716 S 1.3 0.4 0:00.04 httpd
    21401 nobody 29 4 28648 12m 2740 S 1.3 0.4 0:00.04 httpd
    19875 nobody 20 4 28336 12m 2844 S 1.0 0.4 0:01.43 httpd
    20945 nobody 19 4 28252 12m 2796 S 1.0 0.4 0:00.32 httpd
    20964 nobody 19 4 29884 14m 2848 S 1.0 0.4 0:00.90 httpd
    20974 nobody 19 4 28252 12m 2836 S 1.0 0.4 0:00.52 httpd
    21359 nobody 19 4 29288 13m 2828 S 1.0 0.4 0:00.13 httpd
    21402 nobody 29 4 27896 12m 2708 S 1.0 0.4 0:00.03 httpd
    21404 nobody 29 4 27892 11m 2712 R 1.0 0.4 0:00.03 httpd
    1622 root 12 -5 0 0 0 S 0.7 0.0 0:08.14 kjournald
    21189 nobody 19 4 30792 15m 2836 S 0.7 0.5 0:00.28 httpd
    21376 nobody 19 4 24456 9372 2760 S 0.7 0.3 0:00.07 httpd
    2670 root 29 4 23652 9272 3836 S 0.3 0.3 0:01.68 httpd
    20242 nobody 20 4 29308 13m 2848 S 0.3 0.4 0:00.98 httpd
    20299 nobody 19 4 29432 14m 3172 S 0.3 0.4 0:00.95 httpd
    20873 nobody 19 4 29364 13m 2844 S 0.3 0.4 0:00.67 httpd
    20887 nobody 20 4 32972 16m 2796 S 0.3 0.5 0:00.54 httpd
    20941 nobody 19 4 30680 15m 2844 S 0.3 0.5 0:00.76 httpd
    20952 nobody 19 4 29356 14m 3284 S 0.3 0.4 0:00.42 httpd
    20953 nobody 19 4 29248 13m 2796 S 0.3 0.4 0:00.36 httpd
    20982 nobody 19 4 30108 14m 2844 S 0.3 0.4 0:00.56 httpd
    21184 nobody 19 4 24404 9404 2836 S 0.3 0.3 0:00.13 httpd
    21185 nobody 19 4 26132 10m 2844 S 0.3 0.3 0:00.36 httpd
    21381 nobody 20 4 29160 13m 2732 S 0.3 0.4 0:00.05 httpd
    21384 root 15 0 2328 1096 796 R 0.3 0.0 0:00.01 top
    1 root 15 0 2064 664 572 S 0.0 0.0 0:00.59 init
    2 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/0
    3 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
    4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
    5 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/1
    6 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/1
    7 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/1
    8 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/0
    9 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/1
    10 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khelper
    11 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kthread
    15 root 10 -5 0 0 0 S 0.0 0.0 0:00.12 kblockd/0
    16 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kblockd/1
    17 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 kacpid
    88 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/0
    89 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/1
  8. mistwang

    mistwang LiteSpeed Staff

    Looks like your server performance is bounded by mysql, try command

    mysqladmin processlist

    if a SQL takes too long to process, you need to check the index and optimize the SQL.
  9. robfrew

    robfrew New Member

    I would also try installing the trial version of Litespeed to see if it can help you.
  10. ASTRAPI

    ASTRAPI New Member

    From platinum server support they told me that i have 3 Million hits per day.

    My server is Dual Xeon with 4gb ram and i am planinning to get a Quad Xeon with 8gb ram as this is the best in my datacenter...
  11. mistwang

    mistwang LiteSpeed Staff

    I suggest you try LiteSpeed before upgrading the server. If CPU is not 100% utilized during peak hour, upgrade to Quad Xeon may not help. check the 'top' output.
  12. ASTRAPI

    ASTRAPI New Member

    Ok i will try to read how to install it at wiki but as i am not expert i am not sure if i try it ...

    Thank you
  13. ASTRAPI

    ASTRAPI New Member

    Does this mean that my server is 100% utilized?

    2280 mysql 21 6 146m 105m 3864 S 118.4 3.2 928:32.47 mysqld
    14756 nobody 20 4 31908 15m 2856 S 41.4 0.5 0:00.60 httpd

    Thank you
  14. auser

    auser Super Moderator

    you have 2 core(Xeon dual core), the full load is 200%. So in total, the CPU is not full loaded. but
    Code:
    2280 mysql 21 6 146m 105m 3864 S 118.4 3.2 928:32.47 mysqld
    
    mysqld has exceeded 100%(118.4%) so apparently the bottleneck is at mysqld process.

    p.s., what's upper part of "top" output?
  15. ASTRAPI

    ASTRAPI New Member

    I didn't keep the rest but you can check my previous output :

    2280 mysql 21 6 126m 72m 3704 S 149.3 2.2 121:12.99 mysqld
    1621 root 0 -20 0 0 0 R 11.4 0.0 1:47.02 loop0
    20315 nobody 20 4 32024 15m 2876 S 2.3 0.5 0:01.69 httpd
    20933 nobody 19 4 30136 14m 2844 S 2.3 0.4 0:00.45 httpd
    20987 nobody 20 4 32692 16m 2848 S 2.3 0.5 0:00.51 httpd
    20923 nobody 20 4 29076 13m 2840 S 2.0 0.4 0:00.56 httpd
    21378 nobody 20 4 31520 15m 2772 S 2.0 0.5 0:00.11 httpd
    20968 nobody 19 4 25044 9.8m 2844 S 1.6 0.3 0:00.38 httpd
    20997 root 15 0 0 0 0 S 1.6 0.0 0:02.50 pdflush
    21392 nobody 19 4 30020 14m 2708 S 1.6 0.4 0:00.05 httpd
    384 root 10 -5 0 0 0 S 1.3 0.0 0:09.99 kjournald
    21190 nobody 19 4 28300 12m 2844 S 1.3 0.4 0:00.22 httpd
    21398 nobody 27 4 28648 12m 2716 S 1.3 0.4 0:00.04 httpd
    21401 nobody 29 4 28648 12m 2740 S 1.3 0.4 0:00.04 httpd
    19875 nobody 20 4 28336 12m 2844 S 1.0 0.4 0:01.43 httpd
    20945 nobody 19 4 28252 12m 2796 S 1.0 0.4 0:00.32 httpd
    20964 nobody 19 4 29884 14m 2848 S 1.0 0.4 0:00.90 httpd
    20974 nobody 19 4 28252 12m 2836 S 1.0 0.4 0:00.52 httpd
    21359 nobody 19 4 29288 13m 2828 S 1.0 0.4 0:00.13 httpd
    21402 nobody 29 4 27896 12m 2708 S 1.0 0.4 0:00.03 httpd
    21404 nobody 29 4 27892 11m 2712 R 1.0 0.4 0:00.03 httpd
    1622 root 12 -5 0 0 0 S 0.7 0.0 0:08.14 kjournald
    21189 nobody 19 4 30792 15m 2836 S 0.7 0.5 0:00.28 httpd
    21376 nobody 19 4 24456 9372 2760 S 0.7 0.3 0:00.07 httpd
    2670 root 29 4 23652 9272 3836 S 0.3 0.3 0:01.68 httpd
    20242 nobody 20 4 29308 13m 2848 S 0.3 0.4 0:00.98 httpd
    20299 nobody 19 4 29432 14m 3172 S 0.3 0.4 0:00.95 httpd
    20873 nobody 19 4 29364 13m 2844 S 0.3 0.4 0:00.67 httpd
    20887 nobody 20 4 32972 16m 2796 S 0.3 0.5 0:00.54 httpd
    20941 nobody 19 4 30680 15m 2844 S 0.3 0.5 0:00.76 httpd
    20952 nobody 19 4 29356 14m 3284 S 0.3 0.4 0:00.42 httpd
    20953 nobody 19 4 29248 13m 2796 S 0.3 0.4 0:00.36 httpd
    20982 nobody 19 4 30108 14m 2844 S 0.3 0.4 0:00.56 httpd
    21184 nobody 19 4 24404 9404 2836 S 0.3 0.3 0:00.13 httpd
    21185 nobody 19 4 26132 10m 2844 S 0.3 0.3 0:00.36 httpd
    21381 nobody 20 4 29160 13m 2732 S 0.3 0.4 0:00.05 httpd
    21384 root 15 0 2328 1096 796 R 0.3 0.0 0:00.01 top
    1 root 15 0 2064 664 572 S 0.0 0.0 0:00.59 init
    2 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/0
    3 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
    4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
    5 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/1
    6 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/1
    7 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/1
    8 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/0
    9 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/1
    10 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khelper
    11 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kthread
    15 root 10 -5 0 0 0 S 0.0 0.0 0:00.12 kblockd/0
    16 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kblockd/1
    17 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 kacpid
    88 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/0
    89 root 14 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/1

    Thank you

    So i must check for sql optimazation...

    Any tips? :)
  16. anewday

    anewday Moderator

    Mysqltuner is a very good tool. Make sure mysql is running for at least 48 hours before using it.
  17. ASTRAPI

    ASTRAPI New Member

    I just don't get it ....

    Today without to do any settings is working very very fast and i was try to check the output from the top command to check how is going the cpu.

    And from the 100 - 120 as i get when my forum is very slow it was 187%.

    How is this possible ?

    Thank you


    Also does the speed from 100 to 1.000 Mbit will help?
    Last edited: Sep 12, 2009

Share This Page