Latest Announcemnent
New thread

High CPU Usage on VPS

Status
Not open for further replies.
L

LuDo8

Active Member
402
2010
39
0
Hey guys, I get a lot of CPU spikes and I'm not quite sure how to fix it.

http://i.lulzimg.com/2e85d176e2.jpg
http://i.lulzimg.com/5b3174e9bc.jpg

It constantly goes from very low 0-2% to 50-99% as you can see from the two screenshots.

Its a 3GB 3 CPU Core VPS on Centos 5 64bit, Nginx, APC, and MySQL hosting about 2 wordpress sites with a combined daily traffic of about 6k UV/day.

For the VPS specs I know for a fact that is plenty of power for just 6k traffic. And the port connection is 100MBs and I can download from it 5-8MB/s just fine so its not that either.

It seems to be PHP-FPM thats using up all the CPU, but why? And how to fix it?

Thanks in advance
 
21 comments
Could be a DoS or DDoS attack? Sometimes these attacks can cause a high CPU load if it isn't the plugins. Maybe it's just you're experiencing more traffic at certain times? Plus...since you're on a VPS, maybe another site hosted on the VPS is reaching traffic peaks or they're getting attacked and causing your site to lag or get high CPU load or both. If you're not getting attacked or are getting attacked, talk to your host about the problem and maybe they can help you block attacks and prevent them from happening again or move you to a different VPS if it isn't you being attacked.

Log into SSH and read this thread to see if you're being attacked and how to stop it:
http://www.wjunction.com/13-tutorials-guides/43022-block-dos-ddos-attacks-using-iptables-ssh.html
 
Ran the command from the tutorial you linked, and the results were:

Code: 
# netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n
      1 174.141.208.106
      1 174.141.208.108
      1 174.141.208.110
      1 174.141.208.113
      1 184.72.46.206
      1 222.124.59.162
      1 65.91.116.33
      1 65.91.116.34
      1 65.91.117.74
      1 65.91.117.75
      1 66.249.66.10
      1 66.56.8.38
      1 72.233.56.138
      1 80.237.226.74
      1 90.191.186.249
      1 95.13.67.18
      1 Address
      1 and
      2 174.141.208.102
      2 174.141.208.107
      2 174.141.208.109
      2 174.141.208.111
      2 174.141.208.112
      2 174.141.208.98
      2 184.72.46.156
      2 184.72.46.160
      2 199.59.149.166
      2 89.151.116.53
      3 174.141.208.100
      3 174.141.208.101
      3 174.141.208.103
      3 174.141.208.96
      3 174.141.208.97
      3 98.151.190.165
      4 174.141.208.99
      4 199.59.149.31
      4 41.237.211.167
      9 0.0.0.0
     14 86.75.10.55
     32 127.0.0.1
     44 69.31.50.114

Ran it again a few minutes later and it was all gone:

Code: 
# netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n
      1 123.125.71.28
      1 161.69.220.1
      1 222.124.59.162
      1 41.237.211.167
      1 63.232.227.10
      1 67.170.253.61
      1 69.31.50.114
      1 85.100.150.63
      1 89.248.174.73
      1 Address
      1 and
      2 199.59.149.31
      2 79.95.147.166
      2 97.80.128.60
      3 98.151.190.165
      5 95.13.67.18
      6 24.151.180.193
      9 0.0.0.0
     23 127.0.0.1

So I don't think it's a DDoS..I keep thinking it has to do with my configurations since its showing PHP-FPM as the CPU hog, but you brought up a good point regarding someone else using up resources so I'll send a support ticket regarding that.

Thanks so far everyone who has replied. Any other ideas guys?
 
Might be configs then..

Code: 
    44 69.31.50.114

I also highly doubt 44 connections from one IP is even remotely considered an attack.

Just change your settings maybe? try this method again though when you have high CPU usage...maybe we're both right. Maybe we're both wrong?

Anyway, if anyone doesn't have an answer, contact your host and see if they can help you. If you have a good host, they will help to the max and be very resourceful and helpful. Thanks tippie for being my wonderful host when I had a website. <3
 
are you sure cpu load came from your site? as i know it's showing whole server cpu usage, few vps'es on the server..

contact your vps company,
 
@tut2tut

I just verified with the host and the 3 cores are dedicated not shared. So it seems to be a problem on my end.

@DLow , what kind of mySQL, any ideas where to start?

Thanks.
 
LuDo8 said:
@tut2tut

I just verified with the host and the 3 cores are dedicated not shared. So it seems to be a problem on my end.

@DLow , what kind of mySQL, any ideas where to start?

Thanks.
Click to expand...

VPS doesn't normally come with dedicated CPU cores. What CPU do they run on the Node and how much are you paying? You can check with the following command:
# cat /proc/cpuinfo

You may also want to test drives speed. I/O is most important when it comes to VPS Node.
# dd if=/dev/zero of=test bs=64k count=16k conv=fdatasync

Since you run WordPress, make sure you use one of numerous caching plugins out there. I recommend W3 Total Cache.
 
@Lockdown, I don' have any attachments or files available for download so it shouldn't be the problem, but I read through that post and made those edits anyway, hopefully they will make a difference, I will report back on that. Thanks


@Krunix ran the commands you posted:

Code: 
# cat /proc/cpuinfo
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 30
model name      : Intel(R) Xeon(R) CPU           X3470  @ 2.93GHz
stepping        : 5
cpu MHz         : 2933.392
cache size      : 8192 KB
physical id     : 0
siblings        : 8
core id         : 0
cpu cores       : 4
apicid          : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 11
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx rdtscp lm constant_tsc nonstop_tsc pni monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr sse4_1 sse4_2 popcnt lahf_lm
bogomips        : 5866.78
clflush size    : 64
cache_alignment : 64
address sizes   : 36 bits physical, 48 bits virtual
power management: [8]

processor       : 1
vendor_id       : GenuineIntel
cpu family      : 6
model           : 30
model name      : Intel(R) Xeon(R) CPU           X3470  @ 2.93GHz
stepping        : 5
cpu MHz         : 2933.392
cache size      : 8192 KB
physical id     : 0
siblings        : 8
core id         : 1
cpu cores       : 4
apicid          : 2
fpu             : yes
fpu_exception   : yes
cpuid level     : 11
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx rdtscp lm constant_tsc nonstop_tsc pni monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr sse4_1 sse4_2 popcnt lahf_lm
bogomips        : 5866.53
clflush size    : 64
cache_alignment : 64
address sizes   : 36 bits physical, 48 bits virtual
power management: [8]

processor       : 2
vendor_id       : GenuineIntel
cpu family      : 6
model           : 30
model name      : Intel(R) Xeon(R) CPU           X3470  @ 2.93GHz
stepping        : 5
cpu MHz         : 2933.392
cache size      : 8192 KB
physical id     : 0
siblings        : 8
core id         : 2
cpu cores       : 4
apicid          : 4
fpu             : yes
fpu_exception   : yes
cpuid level     : 11
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx rdtscp lm constant_tsc nonstop_tsc pni monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr sse4_1 sse4_2 popcnt lahf_lm
bogomips        : 5866.62
clflush size    : 64
cache_alignment : 64
address sizes   : 36 bits physical, 48 bits virtual
power management: [8]
And for the I/O test:

Code: 
# dd if=/dev/zero of=test bs=64k count=16k conv=fdatasync
16384+0 records in
16384+0 records out
1073741824 bytes (1.1 GB) copied, 8.95598 s, 120 MB/s
Code: 
dd if=/dev/zero of=test bs=64k count=16k conv=fdatasync
16384+0 records in
16384+0 records out
1073741824 bytes (1.1 GB) copied, 9.02439 s, 119 MB/s
I pay about $45 USD/month (with coupon reg. price is $87/month) it seems the I/O good because most others on WHT get 40-80 MB/s on average and I'm 119+

As for the cores, yea I understand most if not all VPS's do NOT come with dedicated cores but $45 isn't really bargain basement price and I specifically asked if they are dedicated or shared. I even worded it, "so no one else can use these cpu cores, only myself correct? and they told me "yes, only you have access to those cores"

If I disable my sites, cpu usage is zero.

The funny thing is when I enable W3 it brings my site down to a crawl, and if I disable it, it becomes twice as fast.
 
Last edited:
Not sure if this is of any help, but I ran mysqltuner , maybe someone can tell me there's too many connections?

One error I noticed for sure is the maximum possible ram usage allowed which is 10.9Gigs I only have 3Gigs of ram, and have no idea how to lower/edit those mysql settings.

Code: 
-------- General Statistics --------------------------------------------------
[--] Skipped version check for MySQLTuner script
[OK] Currently running supported MySQL version 5.1.52-log
[OK] Operating on 64-bit architecture

-------- Storage Engine Statistics -------------------------------------------
[--] Status: -Archive -BDB -Federated -InnoDB -ISAM -NDBCluster
[OK] Total fragmented tables: 0

-------- Security Recommendations  -------------------------------------------
ERROR 1142 (42000) at line 1: SELECT command denied to user ''@'localhost' for table 'user'
[OK] All database users have passwords assigned

-------- Performance Metrics -------------------------------------------------
[--] Up for: 23h 46m 46s (5M q [60.858 qps], 43K conn, TX: 35B, RX: 714M)
[--] Reads / Writes: 97% / 3%
[--] Total buffers: 220.0M global + 70.4M per thread (151 max threads)
[!!] Maximum possible memory usage: 10.6G (353% of installed RAM)
[OK] Slow queries: 0% (0/5M)
[OK] Highest usage of available connections: 16% (25/151)
[!!] Cannot calculate MyISAM index size - re-run script as root user
[OK] Query cache efficiency: 90.9% (4M cached / 5M selects)
[!!] Query cache prunes per day: 165335
[OK] Sorts requiring temporary tables: 7% (6K temp sorts / 88K sorts)
[OK] Temporary tables created on disk: 12% (36K on disk / 291K total)
[OK] Thread cache hit rate: 99% (94 created / 43K connections)
[OK] Table cache hit rate: 65% (120 open / 183 opened)
[OK] Open file limit used: 17% (210/1K)
[OK] Table locks acquired immediately: 99% (986K immediate / 986K locks)

-------- Recommendations -----------------------------------------------------
General recommendations:
    MySQL started within last 24 hours - recommendations may be inaccurate
    Reduce your overall MySQL memory footprint for system stability
    Enable the slow query log to troubleshoot bad queries
Variables to adjust:
  *** MySQL's maximum memory usage is dangerously high ***
  *** Add RAM before increasing MySQL buffer variables ***
    query_cache_size (> 16M)
 
I/O is fairly good.

CPU cores are not dedicated. X3470 has 4 cores in total. If you got 3 dedicated cores for $45 a month they got only 1 core(dedicated right?) to sell.

There are only 2 options.
1) They lied to you.
or
2) They are making a heavy loss on that node.
 
I think you re mistaken.. FIrst I didn't think there was a way to tell how many cores are allocated to your VPS.

Your calculation should by 2 (cpu) x 4 cores = 8

3 for LuDo8 leaves 5 for everyone else... (guessing of course)

But I would have to agree that greed would dictate they would not give you 3 for $45 but only they know for sure.....

It would seem to me if cpu usage goes through the roof with w3 than there is a w3 plugin or script that has gone wild..

Since I don't use w3 can't help there except to say use top -c to see if you can get more information about the malformed script.
 
Last edited:
Status
Not open for further replies.
Back
Top