Load Average über Maximum

pixelpur · Sep 16, 2009

Ein freundlichen guten Morgen in die Runde,

mit Hilfe dieses Forums habe ich schon einige Fragen beantworten können und dafür schon einmal vielen Dank.

Nun habe ich allerdings ein großes Problem mit unserem Server. Es handelt sich hierbei um ein dedicated Server der Firma Strato.

Nach kanpp 24 Stunden hängt sich der Server auf. Die Webseiten und E-Mail sind dann nur noch mit einem Schneckentempo aufrufbar.

Meine Topausgabe gibt mir heute morgen folgendes aus:

Code:

top - 09:14:33 up 11:26,  1 user,  load average: 822.96, 807.97, 759.39
Tasks: 2611 total,   6 running, 2605 sleeping,   0 stopped,   0 zombie
Cpu(s):  5.3%us, 29.6%sy,  0.0%ni, 62.8%id,  2.0%wa,  0.1%hi,  0.2%si,  0.0%st
Mem:   8165544k total,  8088340k used,    77204k free,    66480k buffers
Swap:  2104496k total,    16396k used,  2088100k free,  6320864k cached

Dieser Punkt scheint mir doch etwas verdächtig. load average: 822.96, 807.97, 759.39

Da ich mich erst seit knapp 6 Monaten umfangreicher mit dieser Form des Servers beschäftige bitte ich ein wenig um Nachsicht.

Aktuell ist OpenSuSE 11.0 mit Plesk 9.2.2 installiert. Der Server besitzt 8 GB Speicher und sollte somit nicht all zu schnell an seine Grenzen kommen. Ein paar Logfiles habe ich noch vom Vortag und vielleicht helfen diese Weiter.

Apache Error Log

Code:

[Mon Sep 14 13:45:31 2009] [notice] mod_python: using mutex_directory /tmp
[Mon Sep 14 13:45:31 2009] [notice] mod_bw : Memory Allocated 0 bytes (each conf takes 32 bytes)
[Mon Sep 14 13:45:31 2009] [notice] mod_bw : Version 0.8 - Initialized [0 Confs]
[Mon Sep 14 13:45:32 2009] [notice] Apache/2.2.8 (Linux/SUSE) mod_ssl/2.2.8 OpenSSL/0.9.8g PHP/5.2.9 with Suhosin-Patch mod_python/3.3.1 Python/2.5.2 mod_jk/1.2.21 mod_perl/2.0.4-dev Perl/v5.10.0 configured -- resuming normal operations
[Mon Sep 14 13:56:13 2009] [error] [client 66.249.67.181] File does not exist: /srv/www/vhosts/default/htdocs/robots.txt
[Mon Sep 14 13:56:13 2009] [error] [client 66.249.67.181] File does not exist: /srv/www/vhosts/default/htdocs/php
[Mon Sep 14 14:02:47 2009] [error] [client 66.249.67.181] File does not exist: /srv/www/vhosts/default/htdocs/php
[Mon Sep 14 14:12:05 2009] [error] [client 89.247.208.142] File does not exist: /srv/www/vhosts/default/htdocs/autodiscover
[Mon Sep 14 14:12:08 2009] [error] [client 89.247.208.142] File does not exist: /srv/www/vhosts/default/httpsdocs/autodiscover
[Mon Sep 14 14:12:08 2009] [error] [client 89.247.208.142] File does not exist: /srv/www/vhosts/default/htdocs/autodiscover

Access Log

Code:

::1 - - [14/Sep/2009:14:14:44 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.8 (Linux/SUSE) (internal dummy connection)"
::1 - - [14/Sep/2009:14:14:45 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.8 (Linux/SUSE) (internal dummy connection)"
::1 - - [14/Sep/2009:14:14:53 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.8 (Linux/SUSE) (internal dummy connection)"
::1 - - [14/Sep/2009:14:14:54 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.8 (Linux/SUSE) (internal dummy connection)"
::1 - - [14/Sep/2009:14:14:55 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.8 (Linux/SUSE) (internal dummy connection)"
::1 - - [14/Sep/2009:14:14:56 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.8 (Linux/SUSE) (internal dummy connection)"
::1 - - [14/Sep/2009:14:14:57 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.8 (Linux/SUSE) (internal dummy connection)"
::1 - - [14/Sep/2009:14:14:58 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.8 (Linux/SUSE) (internal dummy connection)"
::1 - - [14/Sep/2009:14:14:59 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.8 (Linux/SUSE) (internal dummy connection)"
::1 - - [14/Sep/2009:14:15:04 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.8 (Linux/SUSE) (internal dummy connection)"

Laufende Prozesse

Code:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         2  0.0  0.0      0     0 ?        S<   16:56   0:00 [kthreadd]
root         3  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [migration/0]
root         4  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [ksoftirqd/0]
root         5  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [migration/1]
root         6  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [ksoftirqd/1]
root         7  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [events/0]
root         8  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [events/1]
root         9  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [khelper]
root        10  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [kblockd/0]
root        11  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [kblockd/1]
root        12  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [kacpid]
root        13  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [kacpi_notify]
root        14  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [cqueue]
root        15  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [kseriod]
root        16  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [kondemand/0]
root        17  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [kondemand/1]
root        18  0.0  0.0      0     0 ?        S    16:56   0:00  \_ [pdflush]
root        19  0.0  0.0      0     0 ?        S    16:56   0:00  \_ [pdflush]
root        20  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [kswapd0]
root        21  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [aio/0]
root        22  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [aio/1]
root        23  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [kpsmoused]
root        63  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [ata/0]
root        64  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [ata/1]
root        65  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [ata_aux]
root        72  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [scsi_eh_0]
root        73  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [scsi_eh_1]
root        74  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [scsi_eh_2]
root        75  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [scsi_eh_3]
root       240  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [ksuspend_usbd]
root       258  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [khubd]
root       531  0.0  0.0      0     0 ?        S<   16:56   0:02  \_ [md1_raid1]
root       550  0.0  0.0      0     0 ?        S<   16:56   0:02  \_ [kjournald]
root       854  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [scsi_eh_4]
root       855  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [scsi_eh_5]
root      1129  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [kauditd]
root      1148  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [kstriped]
root      1156  0.0  0.0      0     0 ?        S<   16:56   0:00  \_ [md0_raid1]
root         1  0.0  0.0    864   328 ?        Ss   16:56   0:00 init [3]
root       601  0.0  0.0  12428   716 ?        S<s  16:56   0:00 /sbin/udevd --daemon
root      1486  0.0  0.0   5916   348 ?        Ss   16:57   0:00 /sbin/resmgrd
100       1490  0.0  0.0  14728   744 ?        Ss   16:57   0:00 /bin/dbus-daemon --system
root      1568  0.0  0.0  32824  2268 ?        Ssl  16:57   0:00 /usr/sbin/console-kit-daemon
101       1665  0.0  0.0  32472  3368 ?        Ss   16:57   0:00 /usr/sbin/hald --daemon=yes
root      1737  0.0  0.0  17804  1184 ?        S    16:57   0:00  \_ hald-runner
root      1826  0.0  0.0  24056  1208 ?        S    16:57   0:00      \_ hald-addon-input: Listening on /dev/input/event2 /dev/input/event1
root      1883  0.0  0.0  24068  1196 ?        S    16:57   0:00      \_ /usr/lib64/hal/hald-addon-cpufreq
101       1903  0.0  0.0  25816  1156 ?        S    16:57   0:00      \_ /usr/lib64/hal/hald-addon-acpi
root      2363  0.0  0.0   8116   300 ?        Ss   16:57   0:00 /sbin/dhcpcd -HHH -D -K -N -t 999999 -h server -c /etc/sysconfig/network/scripts/dhcpcd-hook eth0
root      2551  0.0  0.0  19156  1000 ?        Ss   16:57   0:00 /usr/sbin/xinetd -pidfile /var/run/xinetd.init.pid
qmaild   24042  0.0  0.0  14032  1044 ?        Ss   18:55   0:00  \_ /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
qmaild   25741  0.0  0.0  14032  1052 ?        Ss   19:08   0:00  \_ /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
qmaild   25886  0.0  0.0  14032  1048 ?        Ss   19:10   0:00  \_ /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
qmaild   26390  0.0  0.0  14032  1056 ?        Ss   19:14   0:00  \_ /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
root     26401  0.0  0.0   8248   632 ?        S    19:14   0:00  |   \_ plugins/chkrcptto
qmaild   26397  0.0  0.0  14032  1056 ?        Ss   19:14   0:00  \_ /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
root     26402  0.0  0.0   8248   632 ?        S    19:14   0:00  |   \_ plugins/chkrcptto
qmaild   26403  0.0  0.0  14032  1044 ?        Ss   19:14   0:00  \_ /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
root      2565  0.0  0.0  19016  1004 ?        Ss   16:57   0:03 /sbin/syslog-ng -a /var/lib/named/dev/log
root      2583  0.0  0.0   4092   712 ?        Ss   16:57   0:00 /sbin/klogd -c 1 -x
root      2621  0.0  0.0  21560   888 ?        S    16:57   0:00 /usr/lib/courier-imap/couriertcpd -address=0 -stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd -maxprocs=40 -maxperip=4 -pid=/var/run/imapd.pid -nodnslookup -noidentlookup 143 /usr/sbin/imaplogin /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
root      2625  0.0  0.0  13968  1144 ?        S    16:57   0:00 /usr/sbin/courierlogger imapd
root      2631  0.0  0.0  62120  1296 ?        Ss   16:57   0:00 /usr/sbin/sshd -o PidFile=/var/run/sshd.init.pid
root     26158  0.0  0.0  97772  3672 ?        Ss   19:12   0:00  \_ sshd: root@pts/0
root     26354  0.7  0.0  23880  2972 pts/0    Ss   19:14   0:00      \_ -bash
root     26406  0.0  0.0  13104  1120 pts/0    R+   19:14   0:00          \_ ps auxfwww
root      2657  0.0  0.0  21560   888 ?        S    16:57   0:00 /usr/lib/courier-imap/couriertcpd -address=0 -stderrlogger=/usr/sbin/courierlogger -stderrloggername=imapd-ssl -maxprocs=40 -maxperip=4 -pid=/var/run/imapd-ssl.pid -nodnslookup -noidentlookup 993 /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
root      5733  0.0  0.0  14156  1956 ?        S    17:06   0:00  \_ /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
popuser   5734  0.0  0.0  20768  1628 ?        S    17:06   0:00  |   \_ /usr/bin/imapd Maildir
root      5959  0.0  0.0  14156  1956 ?        S    17:08   0:00  \_ /usr/bin/couriertls -server -tcpd /usr/sbin/imaplogin /usr/lib/courier-imap/authlib/authpsa /usr/bin/imapd Maildir
popuser   5960  0.0  0.0  20768  1616 ?        S    17:08   0:00      \_ /usr/bin/imapd Maildir
root      2661  0.0  0.0  13968  1152 ?        S    16:57   0:00 /usr/sbin/courierlogger imapd-ssl
root      2670  0.0  0.0  21560   888 ?        S    16:57   0:00 /usr/lib/courier-imap/couriertcpd -address=0 -stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d -maxprocs=40 -maxperip=4 -pid=/var/run/pop3d.pid -nodnslookup -noidentlookup 110 /usr/sbin/pop3login /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
root      2676  0.0  0.0  13968  1144 ?        S    16:57   0:00 /usr/sbin/courierlogger pop3d
root      2694  0.0  0.0  21560   880 ?        S    16:57   0:00 /usr/lib/courier-imap/couriertcpd -address=0 -stderrlogger=/usr/sbin/courierlogger -stderrloggername=pop3d-ssl -maxprocs=40 -maxperip=4 -pid=/var/run/pop3d-ssl.pid -nodnslookup -noidentlookup 995 /usr/bin/couriertls -server -tcpd /usr/sbin/pop3login /usr/lib/courier-imap/authlib/authpsa /usr/bin/pop3d Maildir
root      2702  0.0  0.0  13836   972 ?        S    16:57   0:00 /usr/sbin/courierlogger pop3d-ssl
1000      2745  0.0  0.0  46920  3376 ?        S    16:57   0:02 /usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config
sso       2746  0.0  0.0 131324  8084 ?        Ss   16:57   0:00  \_ /usr/bin/sw-engine-cgi
sso       2784  0.0  0.0 131324  3156 ?        S    16:57   0:00  |   \_ /usr/bin/sw-engine-cgi
sso       2788  0.0  0.0 131324  3156 ?        S    16:57   0:00  |   \_ /usr/bin/sw-engine-cgi
sso       2748  0.0  0.0 131324  8088 ?        Ss   16:57   0:00  \_ /usr/bin/sw-engine-cgi
sso       2785  0.0  0.0 131324  3160 ?        S    16:57   0:00  |   \_ /usr/bin/sw-engine-cgi
sso       2786  0.0  0.0 131324  3160 ?        S    16:57   0:00  |   \_ /usr/bin/sw-engine-cgi
sso       2753  0.0  0.0 131324  8088 ?        Ss   16:57   0:00  \_ /usr/bin/sw-engine-cgi
sso       2783  0.0  0.0 131324  3160 ?        S    16:57   0:00  |   \_ /usr/bin/sw-engine-cgi
sso       2787  0.0  0.0 131324  3160 ?        S    16:57   0:00  |   \_ /usr/bin/sw-engine-cgi
sso       2757  0.0  0.0 131324  8084 ?        Ss   16:57   0:00  \_ /usr/bin/sw-engine-cgi
sso       2782  0.0  0.1 134908 15204 ?        S    16:57   0:00      \_ /usr/bin/sw-engine-cgi
sso       2790  0.0  0.1 132348 10400 ?        S    16:57   0:00      \_ /usr/bin/sw-engine-cgi
ntp       2855  0.0  0.0  29600  1556 ?        Ss   16:57   0:00 /usr/sbin/ntpd -p /var/run/ntp/ntpd.pid -g -u ntp:ntp -i /var/lib/ntp -c /etc/ntp.conf
root      2863  0.0  0.0  20620   840 ?        Ss   16:57   0:00 /usr/sbin/cron
named     2919  0.0  0.1  72828 11876 ?        Ssl  16:57   0:00 /usr/sbin/named -t /var/lib/named -u named
root      2955  0.0  0.0  13308  1536 ?        S    16:57   0:00 /bin/sh /usr/bin/mysqld_safe --mysqld=mysqld --user=mysql --pid-file=/var/lib/mysql/mysqld.pid --socket=/var/lib/mysql/mysql.sock --datadir=/var/lib/mysql
mysql     3005  0.4  0.3 212284 28508 ?        Sl   16:57   0:34  \_ /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/mysqld.pid --skip-external-locking --port=3306 --socket=/var/lib/mysql/mysql.sock
postgres  3066  0.0  0.0 105412  4500 ?        Ss   16:57   0:02 /usr/bin/postmaster -D /var/lib/pgsql/data
postgres  3102  0.0  0.0  67048  1192 ?        Ss   16:57   0:00  \_ postgres: logger process
postgres  3104  0.0  0.0 105412  1584 ?        Ss   16:57   0:00  \_ postgres: writer process
postgres  3105  0.0  0.0 105412  1340 ?        Ss   16:57   0:00  \_ postgres: wal writer process
postgres  3106  0.0  0.0 105520  1668 ?        Ss   16:57   0:00  \_ postgres: autovacuum launcher process
postgres  3107  0.0  0.0  67044  1332 ?        Ss   16:57   0:00  \_ postgres: stats collector process
root      3131  0.0  0.5 106916 46432 ?        Ss   16:57   0:02 /usr/sbin/spamd --username=popuser --daemonize --nouser-config --helper-home-dir=/var/qmail --max-children 5 --create-prefs --virtual-config-dir=/var/qmail/mailnames/%d/%l/.spamassassin --pidfile=/var/run/spamd/spamd_full.pid --socketpath=/tmp/spamd_full.sock
popuser   3140  0.6  0.6 115180 54568 ?        S    16:57   0:53  \_ spamd child                                                                                                                                                                          
popuser   3141  0.1  0.6 114312 53692 ?        S    16:57   0:11  \_ spamd child                                                                                                                                                                          
qmails    3180  0.0  0.0   3880   584 ?        S    16:57   0:00 qmail-send
qmaill    3181  0.0  0.0   3824   568 ?        S    16:57   0:00  \_ splogger qmail
root      3182  0.0  0.0   3864   480 ?        S    16:57   0:00  \_ qmail-lspawn | /usr/bin/deliverquota ./Maildir
qmailr    3183  0.0  0.0   3860   484 ?        S    16:57   0:00  \_ qmail-rspawn
qmailq    3184  0.0  0.0   3820   432 ?        S    16:57   0:00  \_ qmail-clean
root      3351  0.0  0.5 399972 44156 ?        Ss   16:57   0:05 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun    3362  0.0  0.4 398188 33900 ?        S    16:57   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   23815  0.0  0.5 406492 44284 ?        S    18:53   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   23892  0.0  0.4 400312 39596 ?        S    18:54   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   24296  0.0  0.5 404588 44040 ?        S    18:57   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   24763  0.0  0.4 400416 38908 ?        S    19:00   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   25720  0.0  0.5 403252 42304 ?        S    19:08   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   25758  0.0  0.4 400344 38916 ?        S    19:08   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26136  0.0  0.4 399972 36928 ?        S    19:12   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26137  0.0  0.4 399972 36924 ?        S    19:12   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26139  0.0  0.4 399972 36952 ?        S    19:12   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26140  0.0  0.4 399972 36944 ?        S    19:12   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26143  0.0  0.4 399972 36852 ?        S    19:12   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26294  0.0  0.4 399972 36912 ?        S    19:13   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26310  0.0  0.4 399972 36212 ?        S    19:13   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26312  0.0  0.4 399972 36212 ?        S    19:13   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26313  0.0  0.4 399972 36216 ?        S    19:13   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26318  0.0  0.4 399972 36216 ?        S    19:13   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26319  0.0  0.4 399972 36216 ?        S    19:13   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26320  0.0  0.4 399972 36216 ?        S    19:13   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
wwwrun   26321  0.0  0.4 399972 36216 ?        S    19:13   0:00  \_ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -DSSL
drweb     3542  0.0  0.3  35220 31604 ?        Ss   16:57   0:04 drwebd.real
drweb     5033  0.0  0.3  35476 31132 ?        S    17:03   0:00  \_ drwebd.real
drweb     5034  0.0  0.3  35220 30872 ?        S    17:03   0:00  \_ drwebd.real
drweb     5035  0.0  0.3  35220 30864 ?        S    17:03   0:00  \_ drwebd.real
drweb     5036  0.0  0.3  35220 30876 ?        S    17:03   0:00  \_ drwebd.real
drweb     5037  0.0  0.3  35476 31152 ?        S    17:03   0:00  \_ drwebd.real
drweb     5038  0.0  0.3  35220 30452 ?        S    17:03   0:00  \_ drwebd.real
drweb     5039  0.0  0.3  35476 31144 ?        S    17:03   0:00  \_ drwebd.real
drweb     5040  0.0  0.3  35220 30872 ?        S    17:03   0:00  \_ drwebd.real
drweb     5041  0.0  0.3  35504 31180 ?        S    17:03   0:00  \_ drwebd.real
drweb     5042  0.0  0.3  35220 30828 ?        S    17:03   0:00  \_ drwebd.real
drweb     5043  0.0  0.3  35220 30452 ?        S    17:03   0:00  \_ drwebd.real
drweb     5044  0.0  0.3  35476 31152 ?        S    17:03   0:00  \_ drwebd.real
drweb     5045  0.0  0.3  35220 30872 ?        S    17:03   0:00  \_ drwebd.real
drweb     5046  0.0  0.3  35220 30260 ?        S    17:03   0:00  \_ drwebd.real
drweb     5047  0.0  0.3  35220 30832 ?        S    17:03   0:00  \_ drwebd.real
drweb     5048  0.0  0.3  35220 30260 ?        S    17:03   0:00  \_ drwebd.real
root      3590  0.0  0.0   3984   648 ?        Ss   16:57   0:00 /sbin/mdadm -F /dev/md0 /dev/md1 -d 60 -m root@localhost -s -c /etc/mdadm.conf
root      3602  0.0  0.0  12516   868 tty1     Ss+  16:57   0:00 /sbin/mingetty --noclear tty1
root      3603  0.0  0.0   3828   596 ttyS0    Ss+  16:57   0:00 /sbin/agetty -L 57600 ttyS0 vt102

Sollten weitere Informationen gewünscht sein, werde ich diese gerne Posten. Der Verdacht liegt noch immer auf einem Spamangriff und vielleicht könnt ihr mir helfen dieses herauszufinden und zu umgehen.

-----EDIT-----

derzeitige Top Ausgabe

Code:

4334 root 20 0 40036 1568 1288 D 1 0.0 0:49.43 executable
4600 root 20 0 40036 1556 1280 D 1 0.0 0:40.75 executable
4732 root 20 0 40036 1552 1284 D 1 0.0 0:38.73 executable
5004 root 20 0 40036 1548 1284 D 1 0.0 0:34.36 executable
5062 root 20 0 40036 1548 1284 D 1 0.0 0:34.20 executable
5507 root 20 0 40036 1568 1288 D 1 0.0 0:30.82 executable
5531 root 20 0 40036 1572 1292 R 1 0.0 0:30.44 executable
5539 root 20 0 40036 1572 1288 D 1 0.0 0:30.44 executable
5643 root 20 0 40036 1548 1284 D 1 0.0 0:29.02 executable
5738 root 20 0 40036 1572 1292 D 1 0.0 0:28.14 executable
5860 root 20 0 40036 1552 1284 D 1 0.0 0:26.60 executable
5888 root 20 0 40036 1552 1284 R 1 0.0 0:26.04 executable
6327 root 20 0 40036 1552 1284 D 1 0.0 0:24.18 executable
6429 root 20 0 40036 1568 1292 D 1 0.0 0:23.36 executable
6455 root 20 0 40036 1572 1292 D 1 0.0 0:22.56 executable
6499 root 20 0 40036 1552 1284 D 1 0.0 0:22.20 executable
6586 root 20 0 40036 1552 1284 D 1 0.0 0:21.34 executable
6741 root 20 0 40036 1556 1280 D 1 0.0 0:19.20 executable
6903 root 20 0 40036 1568 1288 D 1 0.0 0:18.14 executable
6958 root 20 0 40036 1552 1284 D 1 0.0 0:18.62 executable
7096 root 20 0 40036 1560 1280 D 1 0.0 0:17.82 executable
7148 root 20 0 40036 1568 1288 D 1 0.0 0:17.26 executable
7158 root 20 0 40036 1552 1284 D 1 0.0 0:16.66 executable
7185 root 20 0 40036 1548 1284 D 1 0.0 0:16.82 executable
7235 root 20 0 40036 1564 1288 D 1 0.0 0:17.02 executable
7255 root 20 0 40036 1556 1284 D 1 0.0 0:16.84 executable
7306 root 20 0 40036 1552 1284 D 1 0.0 0:16.90 executable
7550 root 20 0 40036 1552 1284 D 1 0.0 0:14.98 executable
7557 root 20 0 40036 1552 1284 D 1 0.0 0:14.98 executable
7679 root 20 0 40036 1544 1276 D 1 0.0 0:14.46 executable
7721 root 20 0 40036 1552 1284 D 1 0.0 0:14.40 executable
7787 root 20 0 40036 1560 1280 D 1 0.0 0:13.94 executable
8216 root 20 0 40036 1556 1284 D 1 0.0 0:12.40 executable
8229 root 20 0 40036 1556 1284 D 1 0.0 0:12.32 executable
8416 root 20 0 40036 1548 1284 D 1 0.0 0:11.78 executable
8528 root 20 0 40036 1552 1284 D 1 0.0 0:10.74 executable
8631 root 20 0 40036 1548 1284 D 1 0.0 0:11.08 executable
8887 root 20 0 40036 1564 1288 R 1 0.0 0:10.26 executable
9112 root 20 0 40036 1552 1284 D 1 0.0 0:09.40 executable
9124 root 20 0 40036 1552 1284 D 1 0.0 0:09.44 executable
9419 root 20 0 40036 1544 1276 D 1 0.0 0:08.30 executable
9742 root 20 0 40036 1572 1292 D 1 0.0 0:06.90 executable
9763 root 20 0 40036 1556 1284 D 1 0.0 0:06.86 executable
10075 root 20 0 40036 1584 1292 D 1 0.0 0:05.22 executable
10431 root 20 0 40036 1564 1280 D 1 0.0 0:04.26 executable
10486 root 20 0 40036 1568 1288 D 1 0.0 0:04.48 executable
10732 root 20 0 40036 1544 1276 D 1 0.0 0:03.64 executable
10861 root 20 0 40036 1572 1288 D 1 0.0 0:03.42 executable
10863 root 20 0 40036 1568 1288 D 1 0.0 0:03.58 executable
11053 root 20 0 40036 1552 1284 D 1 0.0 0:03.02 executable
12563 root 20 0 60856 3456 2320 R 1 0.0 0:00.06 in.proftpd
12564 root 20 0 60856 3456 2320 R 1 0.0 0:00.06 in.proftpd
4011 root 20 0 40036 1552 1284 D 1 0.0 1:03.44 executable
4150 root 20 0 40036 1548 1284 D 1 0.0 0:55.97 executable
4366 root 20 0 40036 1540 1276 D 1 0.0 0:49.29 executable
4423 root 20 0 40036 1552 1284 D 1 0.0 0:47.20 executable
4646 root 20 0 40036 1544 1276 D 1 0.0 0:40.32 executable
4675 root 20 0 40036 1548 1276 D 1 0.0 0:39.99 executable
8993 root 20 0 40036 1568 1292 D 1 0.0 0:10.15 executable
10757 root 20 0 40036 1576 1284 D 1 0.0 0:03.84 executable
4106 root 20 0 40036 1548 1284 D 1 0.0 0:58.27 executable
4460 root 20 0 40036 1600 1292 D 1 0.0 0:46.30 executable
4558 root 20 0 40036 1552 1284 D 1 0.0 0:41.97 executable
4699 root 20 0 40036 1548 1284 D 1 0.0 0:39.43 executable
4739 root 20 0 40036 1552 1284 D 1 0.0 0:38.73 executable
4831 root 20 0 40036 1564 1288 D 1 0.0 0:36.92 executable
4907 root 20 0 40036 1568 1288 D 1 0.0 0:35.42 executable
5080 root 20 0 40036 1548 1284 D 1 0.0 0:33.76 executable
5220 root 20 0 40036 1552 1284 D 1 0.0 0:32.96 executable
5293 root 20 0 40036 1552 1284 D 1 0.0 0:32.34 executable
5343 root 20 0 40036 1540 1276 D 1 0.0 0:32.22 executable

Gruß

Mirco

pixelpur · Sep 16, 2009

Aktuelle Speichermeldung

2.9 GB von 7.8 GB frei

und Kunden bekommen 50 Spammails in der Stunde.

Thorsten · Sep 16, 2009

Hallo!
Was ist executable? Soll / muss / darf das laufen?

mfG
Thorsten

pixelpur · Sep 16, 2009

Wüsste ich auch sehr gerne, nach Neustart des Servers wird dies allerdings gar nicht mehr aufgeführt. Scheint mir eher die Ausgabe zu sein, wenn die Dienst nicht mehr laufen.

Thorsten · Sep 16, 2009

Hallo!
Das ist meiner Meinung nach kein Prozess, der dort in irgend einer Form hingehört. Ist beispielsweise in den Apache Logs auch etwas von executable zu finden?

Wie steht es um die aktulle Mailqueue? Was sagt ein netstat -lnp?

mfG
Thorsten

pixelpur · Sep 16, 2009

netstat -ip

ergibt folgendes:

Code:

Kernel Interface table
Iface   MTU Met   RX-OK RX-ERR RX-DRP RX-OVR   TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0   1500   0 2069107      0      0      0 1082797      0      0      0 BMRU
lo    16436   0   10203      0      0      0   10203      0      0      0 LRU

In der Access_log finde ich aber nette Einträge wie:

Code:

67.16.94.2 - - [15/Sep/2009:11:45:51 +0200] "GET /robots.txt HTTP/1.0" 301 348 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
67.16.94.2 - - [15/Sep/2009:11:45:52 +0200] "GET / HTTP/1.0" 301 338 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"

216.129.119.42 - - [15/Sep/2009:12:58:03 +0200] "GET /robots.txt HTTP/1.0" 404 1042 "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuil.com/twiceler/robot.html)"

und jede Menge:

Code:

::1 - - [16/Sep/2009:12:46:18 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.8 (Linux/SUSE) (internal dummy connection)"

Thorsten · Sep 16, 2009

Hallo!
Das sind leider nicht die Informationen die ich angefordert habe. Was sagt netstat -lnp? Wo befindet sich das ausführbare Programm executable?

mfG
Thorsten

pixelpur · Sep 16, 2009

Sorry, dass ich blöd frage aber über welchen Befehl finde ich die Suche nach executable???

Bei netstat bekomme ich nur:

Code:

Kernel Interface table
Iface   MTU Met   RX-OK RX-ERR RX-DRP RX-OVR   TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0   1500   0 2095440      0      0      0 1117796      0      0      0 BMRU
lo    16436   0   12148      0      0      0   12148      0      0      0 LRU

Thorsten · Sep 16, 2009

Hallo!
Der Befehl zum suchen heist locate. Und jetzt bitte ich dich zum Dritten mal, die Ausgabe von netstat -lnp (-lnp sind die Parameter für netstat) zu liefern.

mfG
Thorsten

docHouse · Sep 16, 2009

Hi,
das ist ein Bug in Plesk 9.2

Siehe auch https://serversupportforum.de/threads/greylisting-executable-problem.33335/.

Ggf. auch => http://kb.parallels.com/en/6410

Grüße

pixelpur · Sep 16, 2009

ok, hatte es mit i geschrieben, wie gesagt bin eher ein Leie in dieser Hinsicht.

Code:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      2632/couriertcpd
tcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN      2715/couriertcpd
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      2932/mysqld
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN      2703/xinetd
tcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN      2689/couriertcpd
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN      2615/couriertcpd
tcp        0      0 0.0.0.0:8880            0.0.0.0:*               LISTEN      2729/sw-cp-serverd
tcp        0      0 127.0.0.1:10001         0.0.0.0:*               LISTEN      2729/sw-cp-serverd
tcp        0      0 0.0.0.0:465             0.0.0.0:*               LISTEN      2703/xinetd
tcp        0      0 0.0.0.0:11443           0.0.0.0:*               LISTEN      2729/sw-cp-serverd
tcp        0      0 0.0.0.0:11444           0.0.0.0:*               LISTEN      2729/sw-cp-serverd
tcp        0      0 81.169.187.46:53        0.0.0.0:*               LISTEN      2854/named
tcp        0      0 127.0.0.2:53            0.0.0.0:*               LISTEN      2854/named
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      2854/named
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN      2703/xinetd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      2586/sshd
tcp        0      0 127.0.0.1:3000          0.0.0.0:*               LISTEN      3471/drwebd.real
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      2991/postmaster
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      2854/named
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      2703/xinetd
tcp        0      0 0.0.0.0:8443            0.0.0.0:*               LISTEN      2729/sw-cp-serverd
tcp        0      0 :::80                   :::*                    LISTEN      3250/httpd2-prefork
tcp        0      0 :::53                   :::*                    LISTEN      2854/named
tcp        0      0 :::22                   :::*                    LISTEN      2586/sshd
tcp        0      0 ::1:953                 :::*                    LISTEN      2854/named
tcp        0      0 :::443                  :::*                    LISTEN      3250/httpd2-prefork
udp        0      0 0.0.0.0:49412           0.0.0.0:*                           2854/named
udp        0      0 81.169.187.46:53        0.0.0.0:*                           2854/named
udp        0      0 127.0.0.2:53            0.0.0.0:*                           2854/named
udp        0      0 127.0.0.1:53            0.0.0.0:*                           2854/named
udp        0      0 81.169.187.46:123       0.0.0.0:*                           2795/ntpd
udp        0      0 127.0.0.2:123           0.0.0.0:*                           2795/ntpd
udp        0      0 127.0.0.1:123           0.0.0.0:*                           2795/ntpd
udp        0      0 0.0.0.0:123             0.0.0.0:*                           2795/ntpd
udp        0      0 :::44338                :::*                                2854/named
udp        0      0 :::53                   :::*                                2854/named
udp        0      0 fe80::224:21ff:fe5f:123 :::*                                2795/ntpd
udp        0      0 ::1:123                 :::*                                2795/ntpd
udp        0      0 :::123                  :::*                                2795/ntpd
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING     4277   1756/hald           @/var/run/hald/dbus-l8km5HH4Jd
unix  2      [ ACC ]     STREAM     LISTENING     6408   2730/sw-engine-cgi  /tmp/sso_main.phpapi.socket-0
unix  2      [ ACC ]     STREAM     LISTENING     6414   2733/sw-engine-cgi  /tmp/sso_main.phpapi.socket-1
unix  2      [ ACC ]     STREAM     LISTENING     6436   2734/sw-engine-cgi  /tmp/sso_main.phprelay.socket-0
unix  2      [ ACC ]     STREAM     LISTENING     6439   2735/sw-engine-cgi  /tmp/sso_main.phprelay.socket-1
unix  2      [ ACC ]     STREAM     LISTENING     6976   2991/postmaster     /tmp/.s.PGSQL.5432
unix  2      [ ACC ]     STREAM     LISTENING     123048 19115/spamd_full.so /tmp/spamd_full.sock
unix  2      [ ACC ]     STREAM     LISTENING     4282   1756/hald           @/var/run/hald/dbus-0dIrEDhvXD
unix  2      [ ACC ]     STREAM     LISTENING     15460  3471/drwebd.real    /var/drweb/run/.daemon
unix  2      [ ACC ]     STREAM     LISTENING     3682   1507/dbus-daemon    /var/run/dbus/system_bus_socket
unix  2      [ ACC ]     STREAM     LISTENING     6865   2932/mysqld         /var/lib/mysql/mysql.sock
unix  2      [ ACC ]     STREAM     LISTENING     3672   1478/resmgrd        /var/run/.resmgr_socket

pixelpur · Sep 16, 2009

Ok folgende Beschreibung habe ich nun einmal nachvollzogen:

1) POP before SMTP deaktivieren - Wo finde ich diese Option
2) DrWeb komplett deinstallieren - Dienst nur beendet, Deinstallation über Plesk oder Shell?
3) Individuellen Spamfilter pro Domain deaktiveren - ist deaktiviert

Hoffe, dass das schon einige Fehler beseitigt, könnte man gewisse Probleme noch mit einer Neuinstallation des Systems auf 11.1 und Plesk 2.2 beseitigen oder ist dies irrelevant? Schon mal vielen Dank für die Hilfestellungen, ich hoffe der Server lässt mich nun wieder eine Nacht schlafen. Vielleicht könnt Ihr mir noch die beiden ersten Punkte beantworten.

EDIT:

Gerade Rückmeldung zweier Kunden, diese bekommen noch immer 40 Spammails in der Stunde. Problem scheint somit auch mit den oben genannten Maßnahmen nicht behoben.

Load Average über Maximum

pixelpur

New Member

pixelpur

New Member

Thorsten

SSF Facilitymanagement

pixelpur

New Member

Thorsten

SSF Facilitymanagement

pixelpur

New Member

Thorsten

SSF Facilitymanagement

pixelpur

New Member

Thorsten

SSF Facilitymanagement

docHouse

New Member

pixelpur

New Member

pixelpur

New Member