• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

Highly CPU performance being consumed / 502 Bad Gateway nginx

Velli

Active member
#1
Hi,

My website have been running slowly for a couple of days and has been shutting down with errors like "502 Bad Gateway Ngnix".
I have been looking at the settings in Xenforo and apparently everything is fine.

When getting in the server I found out that the CPU's performance is being consumed to its maximum capacity. Something really unusual.

XF1.PNG

I'm not hat expert on servers so I tried the common (restarting of servers or services (Mysql, Ngnix, php-fpm))

I've been trying to look for a solution on the Internet, but didn't have any luck (or I didn't understand). So that's why I want you guys to help me fix this error that's has been running on my website for a couple of days.

I could offer you some data for your interest in case it can help you find the issue.

-------------------
Dual Intel Xeon 5420
RAM 8GB
Operating System CentOS 64-bit
1TB Hard Drive
-------------------

XF2.PNG

Thanks!!!
 

Tracy Perry

Well-known member
#2
When the use is high like that, what does
Code:
netstat -antu | grep :80 | grep -v LISTEN | awk '{print $5}' | cut -d: -f1 | sort | uniq -c
return (that assumes your HTTP port is 80, if using HTTPS then also run a second time replacing :80 with :443)
If those numbers are really high - especially for a few singular IP's (or a LOT of different IP's)

In your http log (web server) do you see similar to this
Code:
74.86.132.186 - - [09/Mar/2014:11:05:27 -0400] "GET /?4137049=6431829 HTTP/1.0" 403 0 "-" "WordPress/3.8; http://www.mtbgearreview.com"
121.127.254.2 - - [09/Mar/2014:11:05:27 -0400] "GET /?4758117=5073922 HTTP/1.0" 403 0 "-" "WordPress/3.4.2; http://www.kschunvmo.com"
217.160.253.21 - - [09/Mar/2014:11:05:27 -0400] "GET /?7190851=6824134 HTTP/1.0" 403 0 "-" "WordPress/3.8.1; http://www.intoxzone.fr"
193.197.34.216 - - [09/Mar/2014:11:05:27 -0400] "GET /?3162504=9747583 HTTP/1.0" 403 0 "-" "WordPress/2.9.2; http://www.verwaltungmodern.de"
(the domains will be different but the structure of the HTTP/1.0 sequence will be similar)
If so, then you are the proud recipient of a DDOS attack. ;)
There are other things it could be, but this is one of the first things I always check for so if I contact my host I don't get sold a "bill of sale" for oxen when I just needed a few geese.
 

Tracy Perry

Well-known member
#5
That's no load at all... are you currently getting the errors? You need to run that when you are noticing a slow down.
You also need to check your HTTP server logs - and probably your PHP processor logs for good measure also.
Also, if you don't redirect ALL port 80 traffic to 443, you need to run both.
 

Velli

Active member
#6
Not actually. It normalizes.
In the afternoon / night is when it starts the high load.

htop.PNG

I'll check when the server get heavy again.

You also need to check your HTTP server logs - and probably your PHP processor logs for good measure also.
How do I do that? Where do I check?
Sorry about my ignorance in this matter ..

--
Thanks @Tracy Perry !
 

Tracy Perry

Well-known member
#7
If no using CentMin then odds are the nginx log (access and error) are /under /var/log/nginx
The PHP processor will normally (if they are being created) under /var/log or /var/log/php or /var/log/php-fpm... you need to look for any logs with PHP in them.
 

Velli

Active member
#8
If no using CentMin then odds are the nginx log (access and error) are /under /var/log/nginx
The PHP processor will normally (if they are being created) under /var/log or /var/log/php or /var/log/php-fpm... you need to look for any logs with PHP in them.
I use CentMin :p
 

Tracy Perry

Well-known member
#9
the nginx logs will be under /home/nginx/domains/yourdomain.com/log/access.log and error.log
php logs will be under /var/log/php-fpm
also check /var/log/nginx/localhost.access.log and localhost.error.log
 

Velli

Active member
#10
Thanks for the help.
For now, the forum takes three days in good condition without falling.
If this error occurs again, I tell you.