Highly CPU performance being consumed / 502 Bad Gateway nginx

[Velli]

Hi,

My website have been running slowly for a couple of days and has been shutting down with errors like "502 Bad Gateway Ngnix".
I have been looking at the settings in Xenforo and apparently everything is fine.

When getting in the server I found out that the CPU's performance is being consumed to its maximum capacity. Something really unusual.

Spoiler

I'm not hat expert on servers so I tried the common (restarting of servers or services (Mysql, Ngnix, php-fpm))

I've been trying to look for a solution on the Internet, but didn't have any luck (or I didn't understand). So that's why I want you guys to help me fix this error that's has been running on my website for a couple of days.

I could offer you some data for your interest in case it can help you find the issue.

Spoiler: Server

-------------------
Dual Intel Xeon 5420
RAM 8GB
Operating System CentOS 64-bit
1TB Hard Drive
-------------------

Spoiler: php-fpm config

Thanks!!!

 

[TPerry]

When the use is high like that, what does

netstat -antu | grep :80 | grep -v LISTEN | awk '{print $5}' | cut -d: -f1 | sort | uniq -c

return (that assumes your HTTP port is 80, if using HTTPS then also run a second time replacing :80 with :443)
If those numbers are really high - especially for a few singular IP's (or a LOT of different IP's)

In your http log (web server) do you see similar to this

74.86.132.186 - - [09/Mar/2014:11:05:27 -0400] "GET /?4137049=6431829 HTTP/1.0" 403 0 "-" "WordPress/3.8; http://www.mtbgearreview.com"
121.127.254.2 - - [09/Mar/2014:11:05:27 -0400] "GET /?4758117=5073922 HTTP/1.0" 403 0 "-" "WordPress/3.4.2; http://www.kschunvmo.com"
217.160.253.21 - - [09/Mar/2014:11:05:27 -0400] "GET /?7190851=6824134 HTTP/1.0" 403 0 "-" "WordPress/3.8.1; http://www.intoxzone.fr"
193.197.34.216 - - [09/Mar/2014:11:05:27 -0400] "GET /?3162504=9747583 HTTP/1.0" 403 0 "-" "WordPress/2.9.2; http://www.verwaltungmodern.de"

(the domains will be different but the structure of the HTTP/1.0 sequence will be similar)
If so, then you are the proud recipient of a DDOS attack.
There are other things it could be, but this is one of the first things I always check for so if I contact my host I don't get sold a "bill of sale" for oxen when I just needed a few geese.

 

[WSWD]

Yeah, kinda has small DDoS attack written all over it, but hard to say without the logs.

 

[Velli]

Use HTTPS.
I executed the command and this receipt:



Thanks for the quick replys.

 

[TPerry]

That's no load at all... are you currently getting the errors? You need to run that when you are noticing a slow down.
You also need to check your HTTP server logs - and probably your PHP processor logs for good measure also.
Also, if you don't redirect ALL port 80 traffic to 443, you need to run both.

 

[Velli]

Not actually. It normalizes.
In the afternoon / night is when it starts the high load.

Spoiler

I'll check when the server get heavy again.

You also need to check your HTTP server logs - and probably your PHP processor logs for good measure also.

How do I do that? Where do I check?
Sorry about my ignorance in this matter ..

--
Thanks @Tracy Perry !

 

[TPerry]

If no using CentMin then odds are the nginx log (access and error) are /under /var/log/nginx
The PHP processor will normally (if they are being created) under /var/log or /var/log/php or /var/log/php-fpm... you need to look for any logs with PHP in them.

 

[Velli]

If no using CentMin then odds are the nginx log (access and error) are /under /var/log/nginx
The PHP processor will normally (if they are being created) under /var/log or /var/log/php or /var/log/php-fpm... you need to look for any logs with PHP in them.

I use CentMin

 

[TPerry]

the nginx logs will be under /home/nginx/domains/yourdomain.com/log/access.log and error.log
php logs will be under /var/log/php-fpm
also check /var/log/nginx/localhost.access.log and localhost.error.log

 

[Velli]

Thanks for the help.
For now, the forum takes three days in good condition without falling.
If this error occurs again, I tell you.

 

[eva2000]

I use CentMin

As you're using my Centmin Mod LEMP stack, check out thread at Redis - How to install Redis server on Centmin Mod LEMP stack and post regarding installing @Xon's Xenforo Redis Cache addons for redis caching. I am using Redis cache for my Xenforo forums and works very well

 

[eva2000]

Also check out ngxtop https://community.centminmod.com/threads/ngxtop-real-time-metrics-for-nginx.285/