Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > ISPConfig 3 > General

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 14th October 2009, 21:20
jeeva jeeva is offline
Junior Member
 
Join Date: Sep 2009
Posts: 18
Thanks: 0
Thanked 0 Times in 0 Posts
Default server slowing down / apache2 / error 500

Hi

sorry for the vague topic header, but don't know how to describe this really and secondly i dont have much understanding of linux/debian. Running ISPconfig preconfigured & installed on an RPS I buy from OVH.CO.UK.

When I visit my sites, it works fine, but if I play around in my ISPconfig admin panel, and change stuff, (e.g. add a new website), the server goes unresoonsive for quite a while, sometimes up to 20mins. My websites would bring up the ERROR 500 ISPconfig page. When I SSH into the server as root. I get a "new mail" from root.

Stating:
Code:
Message 6:
From root@r25884.ovh.net  Wed Oct 14 05:16:59 2009
X-Original-To: root@r25884.ovh.net
X-Virus-Scanned: Debian amavisd-new at r25884.ovh.net
Subject: [rkhunter] r25884.ovh.net - Daily report
To: root@r25884.ovh.net
Date: Wed, 14 Oct 2009 05:16:38 +0200 (CEST)
From: root@r25884.ovh.net (root)

Warning: The file properties have changed:
         File: /usr/bin/perl
         Current hash: b272c18a5f493859ff57164a188875ed67ce0223
         Stored hash : 713eaf1b9d1eb771b1c2de08ee36138f610f42cb
         Current inode: 99797    Stored inode: 96529
         Current size: 1253828    Stored size: 1254016
         Current file modification time: 1251499526
         Stored file modification time : 1230815058

One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)
Don't know if that means anything, but when I manual restart apache2 I get this problem:

Code:
r25884:~# /etc/init.d/apache2 restart
Restarting web server: apache2[Wed Oct 14 21:18:24 2009] [warn] NameVirtualHost 87.98.167.113:443 has no VirtualHosts
 ... waiting ...[Wed Oct 14 21:18:29 2009] [warn] NameVirtualHost 87.98.167.113:443 has no VirtualHosts
.
My server has 2 IP's [94.23.63.157 & 87.98.167.113]

Can anyone assist in fixing this or, tell me how to. Its quite irritating, since I would like to make use of my webspace.

Thanks in advance.
Reply With Quote
Sponsored Links
  #2  
Old 14th October 2009, 21:30
damir damir is offline
Senior Member
 
Join Date: Jun 2006
Posts: 375
Thanks: 11
Thanked 51 Times in 42 Posts
Default

First message is worrisome because it could be that something is installed on your system or uploaded through bad patched webapp. Was your server patched with the latest patches?

When the server slows down, can you do type uptime to see the load, and later on ps aux to see if you have any unknown services running.

Anything weird in apache, system logs?

Seems like your server is injected with something.
Reply With Quote
  #3  
Old 14th October 2009, 21:44
Mosquito Mosquito is offline
Member
 
Join Date: Nov 2006
Posts: 85
Thanks: 5
Thanked 6 Times in 5 Posts
Default

Have you updated the server (not ISPConfig)? Updates to perl could also trigger the rkhunter message.
Reply With Quote
  #4  
Old 15th October 2009, 09:59
till till is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 36,405
Thanks: 834
Thanked 5,496 Times in 4,326 Posts
Default

Regarding the 500 error. Please take a look at the apache error log file and post the error message that you find there.

Additional question: is this a physical server or vserver?
__________________
Till Brehm
--
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote
  #5  
Old 15th October 2009, 23:14
jeeva jeeva is offline
Junior Member
 
Join Date: Sep 2009
Posts: 18
Thanks: 0
Thanked 0 Times in 0 Posts
Default

Quote:
Originally Posted by till View Post
Regarding the 500 error. Please take a look at the apache error log file and post the error message that you find there.

Additional question: is this a physical server or vserver?
rserver,
real hardware, just the harddrive is on iSCSI. (RPS @ ovh.co.uk)

i've updated the server, still the same problem. I SSH'ed, then I wget a big file like ubuntu distro. Speeds goes from 900 KBps to 0, for about 30 seconds. (during that time i cannot open any websites or anything), then it goes back up to normal download speed. This loops every couple of minutes.

Regards,
Reply With Quote
  #6  
Old 16th October 2009, 00:46
jeeva jeeva is offline
Junior Member
 
Join Date: Sep 2009
Posts: 18
Thanks: 0
Thanked 0 Times in 0 Posts
Default

/var/log/apache2/error.log

http://pastebin.com/m71efe948

how do i fix that ?
Reply With Quote
  #7  
Old 16th October 2009, 08:31
till till is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 36,405
Thanks: 834
Thanked 5,496 Times in 4,326 Posts
Default

Someone seems to try to access random filenames on your server, never seen that before. Please try to scan your server with rkunter.
__________________
Till Brehm
--
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote
  #8  
Old 19th October 2009, 16:41
jeeva jeeva is offline
Junior Member
 
Join Date: Sep 2009
Posts: 18
Thanks: 0
Thanked 0 Times in 0 Posts
Default

is there a way I can completely block/ban those IP ranges from connecting to the machine?
Reply With Quote
  #9  
Old 20th October 2009, 16:45
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,744 Times in 2,577 Posts
Default

Take a look here: http://www.howtoforge.com/forums/sho...42&postcount=4
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #10  
Old 20th October 2009, 20:11
jeeva jeeva is offline
Junior Member
 
Join Date: Sep 2009
Posts: 18
Thanks: 0
Thanked 0 Times in 0 Posts
 
Default

http://pastebin.ca/1633275

thats my rkhunter.log

it gets a warning in

/perl
and
/wget

any idea ?
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Automatic backup of ISPConfig server patrick3853 General 1 14th July 2009 08:31
I don't recieve mail. privir Installation/Configuration 2 3rd June 2009 22:08
Email Clients cannot send mail iverson0881 Installation/Configuration 3 8th May 2008 08:34
The Perfect Setup - Debian Etch (Debian 4.0) some trouble daniel80 HOWTO-Related Questions 26 1st February 2008 16:30
Administrator receive empty mail ??? Stanev General 16 7th April 2006 20:56


All times are GMT +2. The time now is 07:21.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.