Memory Used - 93.8 %?

Discussion in 'Linux VPS/Dedicated - cPanel' started by Carsen, Mar 30, 2007.

  1. Carsen

    Carsen New Member

    Hello,

    I am running a VPS with 128MB RAM and 7GB Space though in the WHM it says "Memory Used - 93.8 %" and is blinking red...So does this mean I should upgrade the RAM? And if not why does it say this I have only used 1.5GB Space..Also is there any cheaper upgrades for RAM? Since I do not really have another $10 to blow a month..

    Thanks,
    Carsen Klock
     
  2. KH-Paul

    KH-Paul CTO Staff Member

    Hi Carsen,

    WHM shows you usage of your guaranteed memory. There are number of ways how to deal with this:
    1) Reduce usage by stopping / disabling not needed services i.e. SpamAssassin is resource intensive, mailman (which is disabled by default) takes good tall on your guaranteed memory, etc;
    2) Keep it as is - you still have access to burstable memory as long as it is available. While it is not a very good idea to run production system within burstable memory range things will still continue to work as long as you don't hit your burstable limits;
    3) Add either memory upgrade (applies to both, guaranteed and burstable limits) to your VPS or upgrade the whole VPS to the next level. In case of VPS-M it makes perfect sense to upgrade to VPS-L as price for VPS-M + 128 MB + cPanel is pretty much the same as VPS-L + cPanel but with VPS-L all other resources will be also increased.

    Regards,
    Paul
     
  3. Carsen

    Carsen New Member

    Yep I have already contacted Billing and Sales on upgrading to VPS L as it seems to be the best..I will be paying them and having it upgraded within a few hours :)

    Thanks,
    Carsen
     
  4. Caleb

    Caleb McDonald's Drywall Expert

    Hey Carsen, just thought I would coment. I have a VPS L and it works perfectly with cpanel so I think it will work best for you.



    Good luck,
    Caleb
     
  5. Carsen

    Carsen New Member

    Ya Thanks I got it upgraded a few days ago :) It is working beautifully and I get a lot more features for a small amount more a month :)
     
  6. lalaland

    lalaland New Member

    I'm having serious memory problems with my VPS despite nothing changing that I can see. It's causing it to crash pretty much every day and each time it's the memory being maxed out.

    I have two questions

    1) How can I identify exactly what is causing this? Knownhost support suggested it was MySql, but I run a forum and nothing's changed on there.

    2) What other services on my server can I disable to free up resources without causing problems?

    Thanks
     
  7. KH-Paul

    KH-Paul CTO Staff Member

    lalaland,

    You can see complete list of all your running processes in the output of the "ps auwwfx" command. This command will show every single process that is running on your system including memory usage information.

    Answer to your second question highly depends on what is running inside your VPS and what services you really need to have running.

    Regards,
    Paul
     
  8. lalaland

    lalaland New Member

    I remember a while back that I was told by KH support that my server was suffering from a DOS attack. They put a temporary block on the IP doing it and it stopped it for a while.

    I am seeing the same symptoms now as before but was recently told by KH support that it's not an attack this time although I can't see any other reason for resource issues as there's no increase in my usage, unless KH have lowered what I have available?

    I still feel as though it's a DOS attack because there's no other reason for it and I just found this on the net http://forums.theplanet.com/lofiversion/index.php/t60807.html

    I followed the instructions for installing the DDOS protection as stated here
    and since doing that my server's memory and CPU are both remaining green for a few minutes. Not sure if it's fixed it properly, but it seems to have stopped it for now.
     
  9. lalaland

    lalaland New Member

    Nope, we're back at 100% memory again:(

    This is causing me problems, I'm going have to move my email to another server or someting as I can't keep losing my email connection when my site's going down.
     
  10. KH-Paul

    KH-Paul CTO Staff Member

    lalaland,

    What did you see in the output of the "netstat -anp |grep :80 | awk '{print $5}' | cut -d: -f1 | sort -n -r " command?
    What is the reason to cross post over two different threads and ignore the questions that might help to understand what's going on? In your list of processes you've provided in your other thread you're using around 500MB of memory. What kind of VPS you have and what sort of traffic do you sites generate?

    Regards,
    Paul
     
  11. lalaland

    lalaland New Member

    I'm not intentionally cross posting, I asked a question on here then started another thread. I didn't see you'd posted on there as I can't get my emails at the moment with my server dying all the time so didn't get an email to say you'd replied or I would have answered sooner.

    Currently the output from that command is that it cannot allocate enough memory. I'll try it after the next reboot.
     
  12. lalaland

    lalaland New Member

    The output is as follows straight after my reboot (this was litterally seconds after the server had rebooted)
     
  13. lalaland

    lalaland New Member

    Output is now showing as
    I have 16 people on the forum and memory is over 60%
     
  14. lalaland

    lalaland New Member

    29 people on, now showing as
    and the server's staying up this time.
     
  15. KH-Paul

    KH-Paul CTO Staff Member

    lalaland,

    Based on port #13 there is a good chance that you got attacked from the 82.10.183.33 IP (unless this is yours IP and you've opened a bunch of connections to your VPS). If this IP is not yours, then block it in your runtime firewall configuration:

    iptables -A INPUT -s 82.10.183.33 -j DROP

    This iptables rule will be removed if you restart iptables, flush iptables rules or reboot the VPS.

    Regards,
    Paul
     
  16. lalaland

    lalaland New Member

    Paul,

    I really appreciate this.

    I know that recently we've been attacked by some ex members of our forum that my moderating team had to ban for breaching a lot of rules over time. Since then they've been attacking our server with all sorts of methods. One of your support team recently picked up on this and did what you've described above, that fixed it for a while. I had to reboot and wasn't aware of the above process (am now, thanks) and will check each time I reboot and block the IP when required.

    I suspect I am under attack a lot, but the last time I contacted support they suggested this wasn't the case as they couldn't see the signs of it. It seems the only logical explanation though, we haven't grown recently and were fine until this idiot started attacking us and when your support member first spotted this they were able to resolve it for a while.

    Now that IP is off my list the server's running fine and staying up without issue.

    I think you've hit the nail on the head.

    Is there anything I can do to stop these people besides this messures, anyone I can report it too as we are being constantly harrased by this individual in both abusive posts under false names and attacks on the server. They are boasting to others about it and my members are all more than aware that we are constantly being attacked and harrased by someone that seems to be untraceable.
     
  17. KH-Paul

    KH-Paul CTO Staff Member

    lalaland,

    If support checked your VPS and said that resource usage comes from normal usage, then this was true at that moment. This doesn't make any sense for us to lie our customers about the situation that happens right inside their VPS unless we want to see more support tickets from you ;)

    82.10.183.33 belongs to "NTL Infrastructure - Waltham Park", here is how abuse coming from this IP can be reported:

    # whois 82.10.183.33
    ...
    remarks: -------------------------------------------------------
    remarks: For abuse notifications please -
    remarks: file an online case @ http://www.virginmedia.com/netreport
    remarks: +44 1633 710142 (Voicemail Only)
    remarks: -------------------------------------------------------
    ...

    Regards,
    Paul
     
  18. lalaland

    lalaland New Member

    I'm being hit again now, not sure if it's the same IP or not that's doing it because I can't use the command as it returns out of memory responses.

    My users are still low and the CPU and memory are rammed through the rough again! I think it's another attack.

    Is there another way to check this when the memory is like this as the command won't currently work for me to identify which IP to block?
     
  19. lalaland

    lalaland New Member

    I restarted the server and before it died (about 30 seconds) I found the IP to be 84.13.125.7 this time using your command.

    I am trying to block it now, but again not enough memory to do that because of the attack so I get a few seconds each reboot.

    This IP doens't trace to any name currently, appears they are using a proxy?
     
  20. KH-Paul

    KH-Paul CTO Staff Member

    netstat needs to be executed from the command line. If you're getting memory errors - try to execute in couple times until it finally run or login to your VZPP go to Services Management and kill couple Apache child processes (processes with UID = 99) to free up some memory and run netstat again.

    Regards,
    Paul
     

Share This Page