Controlling linux/unix server load

Kasinath Kottukkal

Controlling linux/unix server load

Load spikes are results of some resource consuming processes running at that instant. Locating
that process, stopping it and preventing it from happening again it is the key to maintain a healthy load.
These resource consumers can be due to the following and many more:

•scripts being run in background by any user
•incoming spams
•mass mailing (outgoing) from our server
•mysql databases consuming resources
•high apache traffic

How to locate them? Use command tools such as:

$top -c
$ps -aux
$mysqladmin process
prints mysql databases that are being queried
$netstat -plan
prints out all network connections and from there one can grep out and count the no: of
connections per service/port
$/usr/local/cpanel/bin/dcpumonview
in cPanel servers will list each users with cpu usage
Once you figured out program is causing load, try restarting the associated service,
Eg:- From 'top -c' it will list the processes that are having high cpu usage. If that process is say httpd,
try restarting the web service
service httpd restart
If this doesn't control it, locate which user in the server is using that apache traffic or from which IP
most of the apache connections are coming from, you can get that count from each IP but customizing
'netstat -plan' output slightly
If 'top -c' shows it is mysql that is taking load, next step is to determine which database or user is that,
you can have a idea of that from 'mysqladmin process'
If 'top -c' shows a third party perl or bash script running, just locate the PID and kill it.
If it is the mail service in 'top -c', do a 'tail -f /var/log/maillog', you should be able to see if there is a lot
of incoming mails or outgoing ones. If it is incoming ones from a single location, block that IP in
firewall, if outgoing ones, one will have to find out which user or program in the server is sending out
mails.
Please note that locating the exact reason behind any load spike is important, but there can't be single
best fix that can be used in all such cases. A 'Fix' should be determined by considering many things
like the server nature, its clients etc..
For eg:-, disabling a database that is consuming load in a shared server should be ok, but doing the
same in a dedicated server that runs this single one database does no good.