[Phpwm] Problems with live Silverstripe website (httpd spawingproceses, high CPU)

[Pete Graham]

Hi Phil,

It did cross my mind that the high server load could be caused by
someone trying to exploit the site. However from analysing the logs it
appears that their is no naughtiness afoot that I can see.

Pete

On 19 August 2010 08:48,  <phil at infolinkelectronics.co.uk> wrote:
>> Hi everybody,
>>
>> I have a live SilverStripe site I've inherited that I'm experiencing
>> major problems with. After the site has been running for a while it
>> starts spawning multiple httpd processes, some taking up huge
>> percentages of the CPU (these can be seen using top). The site
>> progressively become more and more unresponsive returning 500 errors
>> for requests.
>>
>> Has anyone experienced similar behaviour on a server/site? I'm trying
>> to determine if the problem is with the Apache setup or if it's been
>> caused by the PHP (Silverstripe) application. At first I thought this
>> was most likely to be an server misconfiguration, but the apache setup
>> seems ok. Could some dodgy logic in the PHP cause this behaviour, is
>> it even possible to make Apache (mis)behave like this using PHP? It
>> happens inconsistently which makes trying to fix the problem a joy!
>>
>> The site has low to medium traffic and is on fairly hefty dedicated
>> server so should be able to handle the load easily. I've been running
>> Apache Bench on the live server and profiling the code (on my dev
>> server) however this hasn't shed any light on what's going wrong yet.
>> Any assistance would be greatly appreciated, I'm starting to go
>> slightly mad.
>>
>> Pete
>>
>> ps. Apologies to anyone also on the PHP New Zealand mailing list
>> (unlikely) that recieved a similar email, apparently it's where the
>> Silverstripe devs hangout, but I think their all in bed.
>
> Pete,
> Also check there's no phpmailer type things running that could be externally
> exploited - might be worthwhile putting a copy on a ringfenced server under
> a different URL to see if it's an attack related issue.
>
> Regards,
>
> Phil Beynon
> Sales & Operations Director
>
> ** Infolink Electronic Systems Ltd.
> ** S/W Birmingham's Longest Established ISV & VAR
> ** http://www.infolinkelectronics.co.uk
> ** Professional Web 2.0 Design & Advanced Hosting Platforms
> ** http://www.coeus-computica.co.uk
> ** Affordable Knowledgebase Solutions
> ** Contact: Sales at infolinkelectronics.co.uk
> ** Tel / Fax 0121 441 3558
>
> _______________________________________________
> Phpwm mailing list
> Website : http://www.phpwm.org
> Twitter : http://www.twitter.com/phpwm
> Facebook: http://www.facebook.com/group.php?gid=2361609907
>
> Post to list: Phpwm at mailman.lug.org.uk
> Archive etc : https://mailman.lug.org.uk/mailman/listinfo/phpwm
>