-1

There are about 500 concurrent users. It's because some famous people on social network repost a link.

This happened before. And our server were performing good.

But this time, the server is getting very slow and I noticed that the load is very high. In this picture the load is only 83.22 but that's because I rebooted it. Before rebooting it is 600+ (after editing this post, it's climbing to 200+, and it's still climbing, I guess it'd be above 600 soon)

I noticed that there're so many "ss" process. What are them? Any further advice on this case?

Thanks!

enter image description here

Update: after posting this question, it's getting higher:

enter image description here

Update:

I tried to find the source of this "ss" but it's like this:

enter image description here

Update: added another picture for ps auxw

Update:

Used ps aux | grep ss and listed this:

/bin/sh -c ss -nlp | grep "[,=]27846," || netstat -nlp | grep "[[:space:]]27846/"

enter image description here

AGamePlayer
  • 555
  • 1
  • 5
  • 13

2 Answers2

3

Use ps auxw or ps -ef and look at parent process identifier (PPID) column.

Both netstat and its successor ss are mainly used for monitoring. These are normal admin tools, not any background services. The behavior you see is not normal. I think PPID will lead you to whatever process is spawning these. (Except for a PPID of 1, which usually means the parent had already died.)

kubanczyk
  • 13,502
  • 5
  • 40
  • 55
1

Your website must have some sort of 'current viewers' / 'current connections' hook that is causing it to call out to ss or netstat to get the # of network connections. This is a very heavy thing to do on each page load.

Jason Martin
  • 4,865
  • 15
  • 24
  • What can I do for this case? Is this a normal thing when a lot of traffic rushes in? – AGamePlayer Jan 16 '17 at 10:31
  • No, most websites don't have a connection-counter like this, or they implement it in some other way. I suggest disabling whatever feature you have that is concerned with the # of connections as it is a significant performance issue. – Jason Martin Jan 16 '17 at 16:10