Highly CPU performance being consumed / 502 Bad Gateway nginx

Velli

Active member
Hi,

My website have been running slowly for a couple of days and has been shutting down with errors like "502 Bad Gateway Ngnix".
I have been looking at the settings in Xenforo and apparently everything is fine.

When getting in the server I found out that the CPU's performance is being consumed to its maximum capacity. Something really unusual.

XF1.webp

I'm not hat expert on servers so I tried the common (restarting of servers or services (Mysql, Ngnix, php-fpm))

I've been trying to look for a solution on the Internet, but didn't have any luck (or I didn't understand). So that's why I want you guys to help me fix this error that's has been running on my website for a couple of days.

I could offer you some data for your interest in case it can help you find the issue.

-------------------
Dual Intel Xeon 5420
RAM 8GB
Operating System CentOS 64-bit
1TB Hard Drive
-------------------

XF2.webp

Thanks!!!
 
When the use is high like that, what does
Code:
netstat -antu | grep :80 | grep -v LISTEN | awk '{print $5}' | cut -d: -f1 | sort | uniq -c
return (that assumes your HTTP port is 80, if using HTTPS then also run a second time replacing :80 with :443)
If those numbers are really high - especially for a few singular IP's (or a LOT of different IP's)

In your http log (web server) do you see similar to this
Code:
74.86.132.186 - - [09/Mar/2014:11:05:27 -0400] "GET /?4137049=6431829 HTTP/1.0" 403 0 "-" "WordPress/3.8; http://www.mtbgearreview.com"
121.127.254.2 - - [09/Mar/2014:11:05:27 -0400] "GET /?4758117=5073922 HTTP/1.0" 403 0 "-" "WordPress/3.4.2; http://www.kschunvmo.com"
217.160.253.21 - - [09/Mar/2014:11:05:27 -0400] "GET /?7190851=6824134 HTTP/1.0" 403 0 "-" "WordPress/3.8.1; http://www.intoxzone.fr"
193.197.34.216 - - [09/Mar/2014:11:05:27 -0400] "GET /?3162504=9747583 HTTP/1.0" 403 0 "-" "WordPress/2.9.2; http://www.verwaltungmodern.de"
(the domains will be different but the structure of the HTTP/1.0 sequence will be similar)
If so, then you are the proud recipient of a DDOS attack. ;)
There are other things it could be, but this is one of the first things I always check for so if I contact my host I don't get sold a "bill of sale" for oxen when I just needed a few geese.
 
That's no load at all... are you currently getting the errors? You need to run that when you are noticing a slow down.
You also need to check your HTTP server logs - and probably your PHP processor logs for good measure also.
Also, if you don't redirect ALL port 80 traffic to 443, you need to run both.
 
Not actually. It normalizes.
In the afternoon / night is when it starts the high load.

htop.webp

I'll check when the server get heavy again.

You also need to check your HTTP server logs - and probably your PHP processor logs for good measure also.
How do I do that? Where do I check?
Sorry about my ignorance in this matter ..

--
Thanks @Tracy Perry !
 
If no using CentMin then odds are the nginx log (access and error) are /under /var/log/nginx
The PHP processor will normally (if they are being created) under /var/log or /var/log/php or /var/log/php-fpm... you need to look for any logs with PHP in them.
 
If no using CentMin then odds are the nginx log (access and error) are /under /var/log/nginx
The PHP processor will normally (if they are being created) under /var/log or /var/log/php or /var/log/php-fpm... you need to look for any logs with PHP in them.
I use CentMin :P
 
the nginx logs will be under /home/nginx/domains/yourdomain.com/log/access.log and error.log
php logs will be under /var/log/php-fpm
also check /var/log/nginx/localhost.access.log and localhost.error.log
 
Thanks for the help.
For now, the forum takes three days in good condition without falling.
If this error occurs again, I tell you.
 
Back
Top Bottom