Hi I used this to make my server: http://www.howtoforge.com/perfect-server-ubuntu-11.04-ispconfig-3 It has been running very well for about 6month but today it was non responsive I can login, it takes 10min for screen to refresh. CPU is constantly on 100% When i manage to stop Apache it responds normally again I can see there are very many processes with user: web26 I dont know what that means through Anyh suggestion how to troble shoot from here? I cant get in to ispconfig as it goes to standstill as soon as I start apache See attached for top command output Regards Morten
It might be that website 26 has been hacked. To find the site, run: ls -la /var/www | grep web26 this will show you the domain name for the web26 site. Then run: a2dissite domain.tld replace domain.tld with the real domain name. Then you should be able to start apache again. Next you should investigate whats wrong in site 26.
Hi Till Thanks for your reply Yes I found out what site it was based on that, however when I came back into the server it suddenly looked fine. Also the website for web26 Very strange. Not sure if it was a temp thing or it will happen again. Will monitor. I was trying to find some information about this with the user. Do you mind giving me some keywords on the subject so I can read further in to it When a visitor visits a website, is it normal that a process for that sites user will start? In what situation will a process for a user like web26 start? its not connected with the sites joomla login or ispconfig customer login. Is it? Thanks for your help so far Regards Morten44
From the looks of it you needed more memory for the configuration of Apache that your running. Anytime that Linux is using swap is very bad Can you provide me another picture of top please. There is some usernames running there that wouldn't be if you followed one of the howto's No one in linux would use the name administrator
Hi Thanks for your reply and making me aware of the swap issue We have a virtual enviroment so have allocated some more memory so hopefully that should fix it The administrator: The person who helped me setting it up created an administrator user and thats the one i use when accessing the remove server with a light weighted GUI desktop. Usefull for me as in a learning process I think the "top" now shows that its running normally again. Have attached a new screendump. See attached Thanks again Morten
