Memory Used - 93.8 %?

Carsen

New Member
Hello,

I am running a VPS with 128MB RAM and 7GB Space though in the WHM it says "Memory Used - 93.8 %" and is blinking red...So does this mean I should upgrade the RAM? And if not why does it say this I have only used 1.5GB Space..Also is there any cheaper upgrades for RAM? Since I do not really have another $10 to blow a month..

Thanks,
Carsen Klock
 

KH-Paul

CTO
Staff member
Hi Carsen,

WHM shows you usage of your guaranteed memory. There are number of ways how to deal with this:
1) Reduce usage by stopping / disabling not needed services i.e. SpamAssassin is resource intensive, mailman (which is disabled by default) takes good tall on your guaranteed memory, etc;
2) Keep it as is - you still have access to burstable memory as long as it is available. While it is not a very good idea to run production system within burstable memory range things will still continue to work as long as you don't hit your burstable limits;
3) Add either memory upgrade (applies to both, guaranteed and burstable limits) to your VPS or upgrade the whole VPS to the next level. In case of VPS-M it makes perfect sense to upgrade to VPS-L as price for VPS-M + 128 MB + cPanel is pretty much the same as VPS-L + cPanel but with VPS-L all other resources will be also increased.

Regards,
Paul
 

Carsen

New Member
Hi Carsen,

WHM shows you usage of your guaranteed memory. There are number of ways how to deal with this:
1) Reduce usage by stopping / disabling not needed services i.e. SpamAssassin is resource intensive, mailman (which is disabled by default) takes good tall on your guaranteed memory, etc;
2) Keep it as is - you still have access to burstable memory as long as it is available. While it is not a very good idea to run production system within burstable memory range things will still continue to work as long as you don't hit your burstable limits;
3) Add either memory upgrade (applies to both, guaranteed and burstable limits) to your VPS or upgrade the whole VPS to the next level. In case of VPS-M it makes perfect sense to upgrade to VPS-L as price for VPS-M + 128 MB + cPanel is pretty much the same as VPS-L + cPanel but with VPS-L all other resources will be also increased.

Regards,
Paul
Yep I have already contacted Billing and Sales on upgrading to VPS L as it seems to be the best..I will be paying them and having it upgraded within a few hours :)

Thanks,
Carsen
 

Caleb

McDonald's Drywall Expert
Hey Carsen, just thought I would coment. I have a VPS L and it works perfectly with cpanel so I think it will work best for you.



Good luck,
Caleb
 

Carsen

New Member
Hey Carsen, just thought I would coment. I have a VPS L and it works perfectly with cpanel so I think it will work best for you.



Good luck,
Caleb
Ya Thanks I got it upgraded a few days ago :) It is working beautifully and I get a lot more features for a small amount more a month :)
 

lalaland

New Member
I'm having serious memory problems with my VPS despite nothing changing that I can see. It's causing it to crash pretty much every day and each time it's the memory being maxed out.

I have two questions

1) How can I identify exactly what is causing this? Knownhost support suggested it was MySql, but I run a forum and nothing's changed on there.

2) What other services on my server can I disable to free up resources without causing problems?

Thanks
 

KH-Paul

CTO
Staff member
lalaland,

You can see complete list of all your running processes in the output of the "ps auwwfx" command. This command will show every single process that is running on your system including memory usage information.

Answer to your second question highly depends on what is running inside your VPS and what services you really need to have running.

Regards,
Paul
 

lalaland

New Member
I remember a while back that I was told by KH support that my server was suffering from a DOS attack. They put a temporary block on the IP doing it and it stopped it for a while.

I am seeing the same symptoms now as before but was recently told by KH support that it's not an attack this time although I can't see any other reason for resource issues as there's no increase in my usage, unless KH have lowered what I have available?

I still feel as though it's a DOS attack because there's no other reason for it and I just found this on the net http://forums.theplanet.com/lofiversion/index.php/t60807.html

I followed the instructions for installing the DDOS protection as stated here
Hello,

Well, maybe you've a DDoS running or someting making severall connections to apache.
If you type 'top', you can see any mysql process?

Try this too: netstat -anp |grep :80 | awk '{print $5}' | cut -d: -f1 | sort -n -r

See if you've many ips listed here. If yes, instal DOS-Deflate:

# wget http://www.inetbase.com/scripts/ddos/install.ddos
# sh install.ddos


Reply my questions and i can help you a litle more.


SL
and since doing that my server's memory and CPU are both remaining green for a few minutes. Not sure if it's fixed it properly, but it seems to have stopped it for now.
 

lalaland

New Member
Nope, we're back at 100% memory again:(

This is causing me problems, I'm going have to move my email to another server or someting as I can't keep losing my email connection when my site's going down.
 

KH-Paul

CTO
Staff member
lalaland,

What did you see in the output of the "netstat -anp |grep :80 | awk '{print $5}' | cut -d: -f1 | sort -n -r " command?
What is the reason to cross post over two different threads and ignore the questions that might help to understand what's going on? In your list of processes you've provided in your other thread you're using around 500MB of memory. What kind of VPS you have and what sort of traffic do you sites generate?

Regards,
Paul
 

lalaland

New Member
I'm not intentionally cross posting, I asked a question on here then started another thread. I didn't see you'd posted on there as I can't get my emails at the moment with my server dying all the time so didn't get an email to say you'd replied or I would have answered sooner.

Currently the output from that command is that it cannot allocate enough memory. I'll try it after the next reboot.
 

lalaland

New Member
The output is as follows straight after my reboot (this was litterally seconds after the server had rebooted)
82.38.195.34
82.38.195.34
80.192.59.44
80.192.59.44
80.192.59.44
0.0.0.0
 

lalaland

New Member
Output is now showing as
89.240.241.69
83.100.181.37
82.38.177.89
82.38.177.89
82.38.177.89
82.38.177.89
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.10.183.33
82.0.177.122
82.0.177.122
82.0.177.122
82.0.177.122
80.192.59.44
74.6.75.19
74.6.70.58
72.30.177.84
0.0.0.0
I have 16 people on the forum and memory is over 60%
 

lalaland

New Member
29 people on, now showing as
86.137.234.173
84.13.121.114
84.13.121.114
84.13.121.114
83.100.181.37
83.100.181.37
82.38.195.34
82.38.195.34
82.38.195.34
82.38.195.34
82.38.177.89
82.38.177.89
82.38.177.89
82.31.4.61
82.31.4.61
82.31.4.61
74.6.71.90
0.0.0.0
and the server's staying up this time.
 

KH-Paul

CTO
Staff member
lalaland,

Based on port #13 there is a good chance that you got attacked from the 82.10.183.33 IP (unless this is yours IP and you've opened a bunch of connections to your VPS). If this IP is not yours, then block it in your runtime firewall configuration:

iptables -A INPUT -s 82.10.183.33 -j DROP

This iptables rule will be removed if you restart iptables, flush iptables rules or reboot the VPS.

Regards,
Paul
 

lalaland

New Member
Paul,

I really appreciate this.

I know that recently we've been attacked by some ex members of our forum that my moderating team had to ban for breaching a lot of rules over time. Since then they've been attacking our server with all sorts of methods. One of your support team recently picked up on this and did what you've described above, that fixed it for a while. I had to reboot and wasn't aware of the above process (am now, thanks) and will check each time I reboot and block the IP when required.

I suspect I am under attack a lot, but the last time I contacted support they suggested this wasn't the case as they couldn't see the signs of it. It seems the only logical explanation though, we haven't grown recently and were fine until this idiot started attacking us and when your support member first spotted this they were able to resolve it for a while.

Now that IP is off my list the server's running fine and staying up without issue.

I think you've hit the nail on the head.

Is there anything I can do to stop these people besides this messures, anyone I can report it too as we are being constantly harrased by this individual in both abusive posts under false names and attacks on the server. They are boasting to others about it and my members are all more than aware that we are constantly being attacked and harrased by someone that seems to be untraceable.
 

KH-Paul

CTO
Staff member
lalaland,

If support checked your VPS and said that resource usage comes from normal usage, then this was true at that moment. This doesn't make any sense for us to lie our customers about the situation that happens right inside their VPS unless we want to see more support tickets from you ;)

82.10.183.33 belongs to "NTL Infrastructure - Waltham Park", here is how abuse coming from this IP can be reported:

# whois 82.10.183.33
...
remarks: -------------------------------------------------------
remarks: For abuse notifications please -
remarks: file an online case @ http://www.virginmedia.com/netreport
remarks: +44 1633 710142 (Voicemail Only)
remarks: -------------------------------------------------------
...

Regards,
Paul
 

lalaland

New Member
I'm being hit again now, not sure if it's the same IP or not that's doing it because I can't use the command as it returns out of memory responses.

My users are still low and the CPU and memory are rammed through the rough again! I think it's another attack.

Is there another way to check this when the memory is like this as the command won't currently work for me to identify which IP to block?
 

lalaland

New Member
I restarted the server and before it died (about 30 seconds) I found the IP to be 84.13.125.7 this time using your command.

I am trying to block it now, but again not enough memory to do that because of the attack so I get a few seconds each reboot.

This IP doens't trace to any name currently, appears they are using a proxy?
 

KH-Paul

CTO
Staff member
netstat needs to be executed from the command line. If you're getting memory errors - try to execute in couple times until it finally run or login to your VZPP go to Services Management and kill couple Apache child processes (processes with UID = 99) to free up some memory and run netstat again.

Regards,
Paul
 
Top