Identifying High-Load Accounts on a Server

Server administrators often encounter challenges when trying to identify which account is generating the highest load on a server.

Below are some tips on how to pinpoint such accounts:

Step 1: Use the top Command

First, execute the top command. This will display the current server load and the processes consuming the most resources.

If you notice that there are too many httpd processes running simultaneously, you can use the following commands to determine which account is generating excessive requests.

These commands work only on servers with WHM server administration software.

1. Display Accounts Generating the Most HTTP Requests

Show the accounts generating the highest number of HTTP requests, along with their request counts:

/usr/bin/lynx -dump -width 500 https://127.0.0.1/whm-server-status | grep GET | awk '{print $12}' | sort | uniq -c | sort -rn | head

Example output:

122 creactive.postaffiliatepro.com
40 prankdial.postaffiliatepro.com
19 loopmasters.postaffiliatepro.com
11 smoketip.postaffiliatepro.com
10 support.qualityunit.com
9 rouxbrands.postaffiliatepro.com
5 wellsprings-health.postaffiliatepro.com
4 ultimatelifespan.postaffiliatepro.com
4 trefagyar.postaffiliatepro.com
2 wincav.postaffiliatepro.com

2. Display Top URLs Executed Most Frequently

Show the top URLs that are executed most frequently on your server across all accounts:

/usr/bin/lynx -dump -width 500 https://127.0.0.1/whm-server-status | grep GET | awk '{print $14}' | sort | uniq -c | sort -rn | head

Example output:

12 /scripts/clickjs.php
8 /accounts/default1/banners/01_macbeth_250_250.gif
7 /accounts/default1/banners/cs10best_2009_11_23(750x100).swf
6 /accounts/default1/banners/ms10best_2009_11_23(250x250).swf
5 /scripts/imp.php?a_aid=OR&a_bid=5cf11f7d&chan=colonzone
5 /accounts/default1/themes/affiliates/_common_templates/img/
5 /accounts/default1/banners/ms10best_2009_11_23(468x60).swf?
5 /accounts/default1/banners/cs10best_2009_11_23(468x60)-1.sw
5 /accounts/default1/banners/cs10best_2009_11_23(120x600)-1.s
5 /accounts/default1/banners/468_60_Multi_Genre.swf?clickTAG=

3. Display Top IP Addresses Generating HTTP Requests

Show the top IP addresses generating the most HTTP requests on your server:

/usr/bin/lynx -dump -width 500 https://127.0.0.1/whm-server-status | grep GET | awk '{print $11}' | sort | uniq -c | sort -rn | head

Example output:

6 75.145.39.210
4 72.234.60.199
3 90.179.240.155
3 88.146.78.52
3 85.67.163.7
3 68.111.119.213
3 204.194.98.16
2 95.103.45.22
2 90.178.178.106
2 90.177.179.143

You can further analyze the results to identify possible abusive users or misconfigured scripts. Try running these commands at different times to spot patterns.