[CentOS] Re: Server resources consumption prevention

Mon Nov 13 14:25:50 UTC 2006
Ugo Bellavance <ugob at camo-route.com>

Abd El-Hameed Ayad wrote:
> I have a CentOS 3.8 server which i manage for web hosting (web server, 
> mail server + database server). Today i got it down because of an 
> attack, here is the last snapshot of top command before server dies
> 
> 09:47:30  up 21 days,  6:54,  1 user,  load average: 363.88, 727.82, 253.42
> 3949 processes: 135 sleeping, 3800 running, 14 zombie, 0 stopped
> CPU states:  cpu    user    nice  system    irq  softirq  iowait    idle
>          total    0.6%    0.0%   99.2%   0.0%     0.0%    0.0%    0.0%
>          cpu00    0.4%    0.0%   99.4%   0.0%     0.0%    0.0%    0.0%
>          cpu01    0.8%    0.0%   99.0%   0.0%     0.1%    0.0%    0.0%
> Mem:  2055236k av, 1935836k used,  119400k free,       0k shrd,  188120k 
> buff
>                  1286892k actv,  165568k in_d,   17336k in_c
> Swap: 2040244k av,   22676k used, 2017568k free                  901000k 
> cached
> 
> PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME CPU COMMAND
> 6515 root      19   0 10048 9.8M  2612 R     3.9  0.4   1:06   1 cpsrvd-ssl
> 7175 root      18   0   564  564   492 S     2.7  0.0   0:03   0 
> couriertcpd
> 10365 nobody    19   0 11020  10M  2352 R     2.5  0.5   0:08   0 httpd
> 1998 root      19   0 10724  10M  2140 R     2.4  0.5   3:02   1 httpd
> 10719 mailnull  19   0  1892 1892  1548 R     1.8  0.0   3:49   0 exim
> 7169 root      19   0   552  552   476 R     1.8  0.0   0:10   1 
> couriertcpd
> 29384 manmoud  25   0   380  380   308 R     1.0  0.0   0:01   0 2-4-21
> 26278 manmoud  24   0   420  420   308 R     0.9  0.0   0:01   1 2-4-21
> 26519 manmoud  25   0   420  420   308 R     0.9  0.0   0:01   1 2-4-21
> 26524 manmoud  25   0   424  424   308 R     0.9  0.0   0:01   1 2-4-21
> 29368 manmoud  25   0   412  412   308 R     0.9  0.0   0:01   1 2-4-21
> 25916 manmoud  24   0   388  388   308 R     0.8  0.0   0:01   0 2-4-21
> 25922 manmoud  25   0   388  388   308 R     0.8  0.0   0:01   0 2-4-21
> 
> Clearly, the user manmod caused this huge load.
> Are there any way to prevent such high load caused by any user on the 
> system except root??

I would really recommend you to use monitoring on this server, I 
personnaly use nagios wich does a very good job.  You can set it up on 
this specific server or on an external one.

> 
> thanx