1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Highly CPU performance being consumed / 502 Bad Gateway nginx

Discussion in 'Server Configuration and Hosting' started by Velli, Mar 22, 2016.

  1. Velli

    Velli Active Member


    My website have been running slowly for a couple of days and has been shutting down with errors like "502 Bad Gateway Ngnix".
    I have been looking at the settings in Xenforo and apparently everything is fine.

    When getting in the server I found out that the CPU's performance is being consumed to its maximum capacity. Something really unusual.


    I'm not hat expert on servers so I tried the common (restarting of servers or services (Mysql, Ngnix, php-fpm))

    I've been trying to look for a solution on the Internet, but didn't have any luck (or I didn't understand). So that's why I want you guys to help me fix this error that's has been running on my website for a couple of days.

    I could offer you some data for your interest in case it can help you find the issue.

    Dual Intel Xeon 5420
    RAM 8GB
    Operating System CentOS 64-bit
    1TB Hard Drive


  2. Tracy Perry

    Tracy Perry Well-Known Member

    When the use is high like that, what does
    netstat -antu | grep :80 | grep -v LISTEN | awk '{print $5}' | cut -d: -f1 | sort | uniq -c
    return (that assumes your HTTP port is 80, if using HTTPS then also run a second time replacing :80 with :443)
    If those numbers are really high - especially for a few singular IP's (or a LOT of different IP's)

    In your http log (web server) do you see similar to this
    Code: - - [09/Mar/2014:11:05:27 -0400] "GET /?4137049=6431829 HTTP/1.0" 403 0 "-" "WordPress/3.8; http://www.mtbgearreview.com" - - [09/Mar/2014:11:05:27 -0400] "GET /?4758117=5073922 HTTP/1.0" 403 0 "-" "WordPress/3.4.2; http://www.kschunvmo.com" - - [09/Mar/2014:11:05:27 -0400] "GET /?7190851=6824134 HTTP/1.0" 403 0 "-" "WordPress/3.8.1; http://www.intoxzone.fr" - - [09/Mar/2014:11:05:27 -0400] "GET /?3162504=9747583 HTTP/1.0" 403 0 "-" "WordPress/2.9.2; http://www.verwaltungmodern.de" 
    (the domains will be different but the structure of the HTTP/1.0 sequence will be similar)
    If so, then you are the proud recipient of a DDOS attack. ;)
    There are other things it could be, but this is one of the first things I always check for so if I contact my host I don't get sold a "bill of sale" for oxen when I just needed a few geese.
    RoldanLT and WSWD like this.
  3. WSWD

    WSWD Well-Known Member

    Yeah, kinda has small DDoS attack written all over it, but hard to say without the logs.
    Tracy Perry likes this.
  4. Velli

    Velli Active Member

    Use HTTPS.
    I executed the command and this receipt:


    Thanks for the quick replys.
  5. Tracy Perry

    Tracy Perry Well-Known Member

    That's no load at all... are you currently getting the errors? You need to run that when you are noticing a slow down.
    You also need to check your HTTP server logs - and probably your PHP processor logs for good measure also.
    Also, if you don't redirect ALL port 80 traffic to 443, you need to run both.
  6. Velli

    Velli Active Member

    Not actually. It normalizes.
    In the afternoon / night is when it starts the high load.


    I'll check when the server get heavy again.

    How do I do that? Where do I check?
    Sorry about my ignorance in this matter ..

    Thanks @Tracy Perry !
  7. Tracy Perry

    Tracy Perry Well-Known Member

    If no using CentMin then odds are the nginx log (access and error) are /under /var/log/nginx
    The PHP processor will normally (if they are being created) under /var/log or /var/log/php or /var/log/php-fpm... you need to look for any logs with PHP in them.
  8. Velli

    Velli Active Member

    I use CentMin :p
  9. Tracy Perry

    Tracy Perry Well-Known Member

    the nginx logs will be under /home/nginx/domains/yourdomain.com/log/access.log and error.log
    php logs will be under /var/log/php-fpm
    also check /var/log/nginx/localhost.access.log and localhost.error.log
  10. Velli

    Velli Active Member

    Thanks for the help.
    For now, the forum takes three days in good condition without falling.
    If this error occurs again, I tell you.
  11. eva2000

    eva2000 Well-Known Member

    Xon and Velli like this.
  12. eva2000

    eva2000 Well-Known Member

Share This Page