0

I have a Linode server that has been under load for a few hours. The configuration is 2 CPU Cores, 4GB memory, 80GB SSD storage mounted as 1 partition, 500MB swap. There's a second hard drive of 30GB which is also SSD. Software is Ubuntu 18.04, Apache 2.4.52, PHP-FPM (Most sites using 8.0, some on 7.2 and 8.1). I'm also using fail2ban and iptables for protection.

Here's the graph that Linode's dashboard shows me

Linode Dashboard

Earlier I was getting spikes in network which corresponded to spikes in CPU usage. It was enough to make the websites on the server not respond (500 error) during the spikes. Now, I have constantly higher than usual disk IO.

Linode has a built in DDoS protection and I asked them about it and they said it didn't trigger any actions from DDoS protection layer. Does this look like an attack?

I've tried several commands but none of them has given me any clues so far.

iostat

iostat

iotop -a :

iotop

vmstat 1 10

vmstat

top : Again there's no process constantly on the list

top

Whip
  • 250
  • 1
  • 2
  • 10
  • 150 `tps` on `sda` and 200 `IOPS` on the graph for >6 hours and no processes in `iotop`? – AlexD Jan 19 '22 at 12:12
  • Not no process but processes come and go with only a few kb/s read and writes. Is it possible to get an average over time by each process? – Whip Jan 19 '22 at 12:41
  • you can run `iotop -a` to accumulate stats. Read `man iotop`. – AlexD Jan 19 '22 at 12:44
  • The problem with that is when the process exits, its removed from the list. So not useful still – Whip Jan 19 '22 at 12:54
  • I don't know if there should be so many www-data processes. I've added the screenshot to the question – Whip Jan 19 '22 at 12:57
  • You can try an alternative `iotop` implementation, it remembers dead processes. https://github.com/Tomas-M/iotop – AlexD Jan 19 '22 at 13:15

0 Answers0