Constant HDD activity

Discussion in 'General' started by dimas, Dec 26, 2011.

  1. dimas

    dimas Member

    Good day, I'd like to ask for your help concerning a problem with my ISPConfig 3 server.

    It's a "perfect setup"-based 64-bit CentOS 5.7 server.

    For a long time everything was perfect. Then yesterday I noticed that the server started to operate very slowly. I mean, VERY SLOWLY - a few minutes for a simple web page to load, having to wait a lot for the login/password prompt while connecting by ssh, etc.

    I also noticed that the HDD led was showing constant disc activity.

    I rebooted the server, and the booting process looked normal (fast, no errors), but shortly afterwards (1-3 minutes) this unusual hard disk activity was back, and the server was again slow.

    I "yum updated" to the latest versions of the software packages, and I also updated to the latest version of ISPConfig. (I have to say that I had to do "yum update" step by step, package by package, because, as I said, I had about 2 minutes of normal server operation upon reboot, after which even yum update took ages.

    ISPConfig update went smoothly, without errors.

    Now I have all the latest software, but the problem is still here. Like I said, there are no errors during the booting process - and it's as fast as it was earlier. Also, the server is fairly new, with 8 gigs of RAM and a lot of free hard disc space.

    I wonder what could be causing this HDD activity? Is there a way to monitor it?

    I tried stopping crond, but the HDD led is still flashing.

    Please kindly help me to find out what's causing the problem.
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Install the utility "iotop", its a tool similar to the normal top command but it shwos you which processes cause the Disk load.

    You should also check your server with rkhunter.
     
  3. dimas

    dimas Member

    Thank you very much for your reply, I'll definitely explore the "iotop" tool.

    At the moment, however, I think that I have found the source of the problem.

    One of my client's sites was an old SMF forum. It was a neglected forum, probably hacked, and so a target for malicious scripts. I explored the logs and found out that these scripts posted dozens of messages per second.

    I disabled this forum and - at least for now - the server operation is normal. I hope that this was indeed the cause of the problem.
     

Share This Page