How to track what causes high CPU usage on linux server?

Question

I am running a normal Joomla website on Godaddy's ultimate hosting plan. There is only one site under this plan.

From time to time, my website will be down and giving "refuse to connect" error. When I check the resource usage, I see graphs like this one, which shows constant CPU usage spike on a single day(12/19).

While over a 7 day range, the graph is like this: where you can see there is a physical memory usage spike lately.

I think these must be the reasons my site is up and down. Now my site is a rather small sites with daily pageview of no more than 3k. So the normal visiting shouldn't be causing this usage spikes. I suspect there must be some misconfiguration( which is unlikely because I just use Godaddy's default cPanel) or some degree of breach. My questions are:

1. In general, what causes high CPU usage and high memory usage?
2. For each of high CPU usage and high memory usage, will they cause the website to be down or just slow?
3. I have SSH access, how do I track the reasons for these usage spikes?

Thanks very much for your help!

Answer 1

My guess is that you have a bot hitting your site and consuming all your resources. If you catch this happening in realtime, log in with SSH and tail the logs — the command will likely be similar to

tail -f /var/log/apache/*log

If you want to see the resources being used, "vmstat" will show you the memory disk and cpu usage. Likewise "top" can show you the processes using the most resources.

Note that CPU resources at 100% is not likely the problem here. You are more likely seeing a large number of simultaneous connections and Apache is not allowing further connections because of how its configured (ie to prevent runaway of the server). This is indicated by the server refused to connect error. As you have available memory you can up the number of simultaneous connections — although you probably want to fix the underlying cause.

Heavy PHP scripts can consume significant CPU. Also if your server is swapping that can slow things down — especially on shared disk. I don't think that's the problem here though.