DirectAdmin Warning: The system load average

If you received an email from DirectAdmin with a subject "Warning: The system load average is 32.73" or a similar, here are basic steps you can do.

First of all you should identify what kind of a server load is that. Where the higher load come from?

Real users

It might be legitimate users browsing your sites, high peaks might be caused by:

• advertising
• sales
• misc

More users come to your server, hence you have the bigger server load. 

Malicious activity 

Or it might be a malicious traffic which you need to stop, high peaks might be caused by:

• brute-force attacks to login pages, such as wp-login.php, /administrator/index.php, /xmlrpc.php, etc
• spamming bots posting comments to forums, feedback forms, registration pages
• other kind of malicious activities

Investigation

In order to identify what kind of a traffic is that you can use the following tools:

• Apache's server-status page. It will help to see the currently running requests to your server.
• MySQL: SHOW PROCESSLIST. It will help to see what SQL queries are running there.
• Server logs under /var/log/nginx/ for NGINX, /var/log/httpd/ for Apache, check domains/ folder there as well.
• PHP-FPM status page

As soon as you identify a source of a higher load you need to apply solutions.

Possible solutions

In order to reduce an effect from malicious actions you can do the following:

• Enable Brute-Force monitor in Directadmin
• Optimize PHP-FPM, MySQL, Apache/Nginx
• Protect/limit access to login pages
• Enable reCaptcha, etc.
• Add your site to CloudFlare

If you are not sure how to deal with the issue you are welcome to hire professionals for this. Check what Poralix offers by the link: https://www.poralix.com/services/fixed-rate-management/