Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > Server Operation

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 14th June 2010, 03:32
HenryTheEight HenryTheEight is offline
Junior Member
 
Join Date: Jan 2008
Posts: 10
Thanks: 0
Thanked 0 Times in 0 Posts
Default Abnormally High Upload Network Usage

Hi,

I have been running 4 servers on VMs (2 DNS, 1 web, 1 mail server), which I have been running untouched and very reliable for months now with ISPconfig perfect setups on Centos 5.4 (all of them). Recently,
I have been experiencing very slow web surfing which I share BW with my servers.

I checked to find on my vm console that all my servers have been using all of my Upload BandWidth (barely any download BW). I don't know what is being uploaded and to whom, but all 4 servers are using equal amounts of BW i.e. 25% each. The duration of max BW can last for a couple of hours at Max then momentary lays idle for a few minutes and max out again. CPU usage on all servers (all single core) is under 25%.

My yum update times out during these max BW periods.

Any one has experienced this?

BTW if I switch off my DNSs the other servers BW goes idle.

Questions
1. Have my severs been compromised? ->how to check?
2. Or is this some external BW attack? -> spiders?
3. Or its normal - just set somthing wrongly?

My linux skills are at novice level so please keep advice simple.
Reply With Quote
Sponsored Links
  #2  
Old 14th June 2010, 04:31
HenryTheEight HenryTheEight is offline
Junior Member
 
Join Date: Jan 2008
Posts: 10
Thanks: 0
Thanked 0 Times in 0 Posts
Default Possible culprit for abnormally high upload usage

Hi,

Further my last post, I notice from the 'top' command that I notice
that a process command call 'named' has been running when upload
BW is being taken once the process stopped the BW when back down to
normal. Under the User column (and the command column) the process is also label 'named'.

Now this process seem to start and stop on its own accord for periods of 10-15mins max then 2-3 pause then starts itself again.

Have my servers been hacked?

can I kill this process? if so how?
Reply With Quote
  #3  
Old 14th June 2010, 05:06
HenryTheEight HenryTheEight is offline
Junior Member
 
Join Date: Jan 2008
Posts: 10
Thanks: 0
Thanked 0 Times in 0 Posts
Default OK I killed the named process which solves the problem but do I need this process

hi,

I have used the 'service named stop' command, which resolves the upload BW problem.

I have also used 'chkconfig named off' command to prevent autostart of the service upon reboot.

May I ask what is the 'named' service for or does, is there any consequence to this action.

Anyone know why could the named service be taking BW, who would it check with on the internet. Is this a known bug? is there a workaround.

I don't want to unknowingly lose functionality due to my above actions which
solves one problem but may create another.

Advice anyone?
Reply With Quote
  #4  
Old 14th June 2010, 09:06
damir damir is offline
Senior Member
 
Join Date: Jun 2006
Posts: 375
Thanks: 11
Thanked 51 Times in 42 Posts
Default

Named is BIND, DNS software.

If you start named and then start to monitor log files, it should show startup of named services. There you should see possibles errors that causes your server high load.
Reply With Quote
  #5  
Old 15th June 2010, 13:33
HenryTheEight HenryTheEight is offline
Junior Member
 
Join Date: Jan 2008
Posts: 10
Thanks: 0
Thanked 0 Times in 0 Posts
Default Where can I get named service logs

Pls advise me.

on how to get service logs for named.

Thanks
Reply With Quote
  #6  
Old 15th June 2010, 14:40
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,711
Thanks: 1,899
Thanked 2,702 Times in 2,545 Posts
Default

Depending on your distribution, the log file is probably /var/log/syslog or /var/log/messages.
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Sending mail ISPConfig 3 but not receivind catza Installation/Configuration 20 19th May 2010 12:47
Unable to connect to Mysql mbascombe Installation/Configuration 12 10th January 2010 22:46
Squid Proxy Caching on Linux obzerver Installation/Configuration 4 13th August 2008 19:51
Public and private network + High Availability Apache Cluster teleted HOWTO-Related Questions 11 28th January 2008 14:29
Perfect Xen 3.0 setup for Debian gurneyzap HOWTO-Related Questions 4 26th March 2006 11:30


All times are GMT +2. The time now is 22:08.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.