Welcome to Centmin Mod Community
Become a Member

Nginx Site is down, CPU High

Discussion in 'Nginx, PHP-FPM & MariaDB MySQL' started by Oxide, May 31, 2016.

  1. Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    7:08 PM
    HTOP: https://instashot.io/i/24w48.png


    boot.log errors:
    Code:
    No kdump initial ramdisk found.[WARNING]
    
    Rebuilding /boot/initrd-2.6.32-573.26.1.el6.x86_64kdump.img
    mktemp: failed to create file via template `/tmp/initrd.img.XXXXXX': No space left on device
    mkdir: cannot create directory `/tmp/initrd.u9PWbm/var': No space left on device
    Saving random seed failed.
    Failed to run mkdumprd
    df -h
    Code:
    Filesystem            Size  Used Avail Use% Mounted on
    /dev/vda1              99G   15G   79G  16% /
    tmpfs                 3.8G     0  3.8G   0% /dev/shm
    /home/usertmp_donotdelete
                          3.7G 1003M  2.6G  28% /tmp

    No idea what's going on. I was under an attack. I enabled CloudFlare attack mode and it seems to be working, however the server is still affected by the attack even though there are no attack hitting it now.

    I tried to do ls in /tmp and it wouldn't even show me what's there. It must be full. Can I run rm -rf on tmp then reboot with no issues?
     
  2. Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    7:08 PM
    [​IMG]
     
  3. Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    7:08 PM
    Deleted tmp, and it seems to bring the site online. Any downsides doing so?
     
  4. eva2000

    eva2000 Administrator Staff Member

    55,153
    12,249
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,825
    Local Time:
    7:08 PM
    Nginx 1.27.x
    MariaDB 10.x/11.4+
    /tmp is just temp files usually so should be fine
     
  5. Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    7:08 PM
    I ran rm -rf * in there and even though it gave that error i assume it deleted some? i also ran other commands to try to delete it such as find.

    once i did that it came back online quickly, it seems like mysql was causing high cpu usage as well as php since the directory was full perhaps? it had thousands and thousands, maybe even milions of files.

    i was under attack, called "PHP Session Attack" it generate tons of unused sessions.