0

I have a Debian server (Amazon AWS) with a PHP web application that is used by hundreds of users.

My CPU usage is almost always below 10%. Today around 12:00AM~ I had 2 insane jumps to 100% for exactly 1 minute and then got back to normal.

I am trying to figure out what exactly made this happen, maybe a user is running a script that has to be fixed.

How do I find out happened at this time on my CPU, which commands were running, ect'.

Itai Ganot
  • 10,644
  • 29
  • 93
  • 146
Rick Sanchez
  • 241
  • 1
  • 2
  • 11
  • Is the percentage of CPU usage really a problem? Are your load averages high or is there any actual slow down? – Esa Jokinen Mar 04 '18 at 13:27
  • It could just be a lot of people hit it at the same time by chance, or a small attack. – Tim Mar 04 '18 at 18:40

4 Answers4

1

The best tool for that kind of investigation would be "sar".

"sar" is a Linux builtin command which collects all performance data on an on-going basis, stores them, and allows historical analysis to identify bottlenecks.

If I'm not mistaken it's disabled by default and you need to enable it and enable a cron job which will run and collect events in your system.

So basically what needs to be done is to enable sar, let it run for a few days and the next time you catch this CPU spike, just browse through sar's log files and find what happened in your system in that specific time.

Here's a good resource about "sar".

Itai Ganot
  • 10,644
  • 29
  • 93
  • 146
0

Try some cpu monitoring tool and run it for some time and check out the logs...if you are using WordPress or any kind of CMS tools then try disabling the plugins and check.

Paventhan
  • 11
  • 2
0

Try new relic APM. This is great for monitoring web apps

Gordon Snappleweed
  • 85
  • 1
  • 10
0

Few things to note here

  1. Your site may be hit by many people/IP's at once
  2. Your code/script may be hogging or might have a loop that did not end

To fix this you would rather utilize multiple cores/threads of your server, try to optimize your code

As you have the time noted down, Check the logs to check which particular script has run at that point of time

Venkata S S Krishna Manikeswar
  • 45
  • 2
  • 7