: How to find what is maxing out my entry processes? My site has been going down due to the max number of Entry Processes being hit. Here's a screenshot from cPanel: Looking into the Resource

@Alves908

Web traffic

Check the web logs to see which pages are being requested. If they're hitting a single page with a bad plug-in then it should show you the Page/Request URI that the user hit. Some things like scripts that resize image uploads can eat resources quickly.

If you were getting a lot of traffic for the webserver then it would likely be someone exploiting the server with a botnet or something of that nature.

Bad web traffic

If you can't seem to determine which page it is on the site, try to use something like Google Webmaster tools to see if they can get to the site and what pages they're seeing. They may have a page indexed that someone is using for an exploit potentially (backdoor). You can search for site:example.com and they'll list all of the indexed pages.

Routine maintenance

Check to make sure that something like a CRON job isn't running that could run the box out of resources. Something that tars or gzips a lot of already compressed content could be the culprit as well. (eg. I had a graphic designer upload a 4gb iso to one of the servers I manage and it was bringing down a VPS during nightly back-ups.)

If you manage the server and can access the box with a command line terminal like SSH, you can run top from the command line and see what process is taking up the resources.

Other

If the server is under a DDoS attack or something of that nature it won't necessarily show up as web traffic because the physical server itself would be handling those requests with whatever the chosen port is. (eg. Someone says your webserver is the authoritative DNS server for something like non-existent-site.com and then floods your site with those requests the server will spend all of its time telling the other boxes that it's not the server they're looking for.)

If it is something like this, you can change the IP (maybe) or try to block the requests with something like iptables as a last resort attempt. This should really be done at the router further up the pipe though.

Vote Up Vote Down