Please Explain Server Spikes

March 3, 2009 4:39 AM

Let's try this again, shall we? The load on this graph shows the server load spiking about every 1.5 hours. I'm trying to find out why.

A few things:
I do not have root access to the box. It is owned by 1&1 (sigh, I know) in Germany. A CMS called TYPO3 is installed on the box and it has a MySQL database behind it.

I have been having some performance issues (slow down, timeouts) with this server and I am trying to see if these spikes have anything to do with it. However, the times of the issues are quite intermittent and do not seem to correspond to the spikes.

My first guess is that due to the regularity of the spikes, it is a cronjob or something running every 1.5 hours. However when I'm logged in via ssh and type crontab -l, I get "crontab: no crontab for USER". So, if it is a crontab, it's probably running at the root level. Is there a way to view all cron processes for all users? Does anybody know of any common processes that would do this?

Another idea is that it might be some kind of bot that is accessing the server at regular intervals, but I can't find any evidence in my logs to point to that.
Is there any sort of log filtering software that would make it easier to specifically determine this kind of thing?

posted by chillmost to Computers & Internet (5 answers total)

Best answer: I'm not 100% certain what the units are on that load graph, but based on that and the other graphs, I'd say that isn't an overloaded server at all. The CPU, memory, and disk graphs don't show anything during the "spikes", and it's hard to overload on processes without overloading at least one of those. So I'd say the server has very little usage and your "spikes" probably show something like an increase from 0% load to 10% load, which looks huge in the graph but is irrelevant.

If the server is secured properly, there's no way you can list root's cronjobs, or any other user's, without root access.

I doubt it's a bot, they'd have to be doing something crazy to cause your performance issues, and you'd probably see that in the CPU or disk graph.

I'd say those spikes have nothing to do with the problem, but I'm not sure where to go from there. Is this your server, or is it shared? Is it a "virtual" server? Is MySQL running on this server or a separate one?
posted by mmoncur at 5:15 AM on March 3, 2009

Best answer: Looking at 1&1's options, is this a "VPS" server or a "Linux Server"? (If it's less than $99 a month, it's a VPS.)

VPS means virtual private server. It means your "server" is really a virtual machine, a piece of software running on a hardware box shared with one or more other customers. If those graphs are showing performance for the virtual server, they don't mean much. The real server could be overloaded by one or more of the other customers.
posted by mmoncur at 5:19 AM on March 3, 2009

Best answer: If you look at the units to the left of your graph, your load graph is in "m" for "milli" - you're not even getting up to 1. Load averages display the number of CPUs-worth of processes you're running; a load average of 1 means you're using the whole CPU, 2 means you're using the CPU and a second process is always waiting, and so on. You're maxing out at around 0.8, which means the whole CPU is never actually in use.
posted by pocams at 5:54 AM on March 3, 2009

Best answer: Sorry, left off before giving any actual advice. As for the actual problem, I'm with mmoncur - it's probably a virtual server with someone else slowing it down. If you want to rule out cron jobs run by root, you can probably log into the box a few minutes before the load spike is due and run "ps auxww >> somefile" repeatedly until it's passed. If root is running a job, you should see it in the ps listing at some point. Caveat: some especially-secure systems won't show other users' jobs in ps, so check that ahead of time.

Other than that, I would collect the actual times and specific symptoms of slowdowns and contact the support department. They may know some other user on the virtual server box is a hog and be willing to move you to another if you're low-usage.
posted by pocams at 5:58 AM on March 3, 2009

Response by poster: It is on a stand alone linux server, not virtual. However, it is managed, meaning there is only so much I can do and see. That's why I don't have root. I know the spikes aren't huge according to that scale, but I just wanted to rule them out.

Maybe it is the OS "breathing".

Thanks for the tips. You all get gold stars.
posted by chillmost at 7:17 AM on March 3, 2009