Search The ForumSearch   RegisterRegister  LoginLogin

AfterLogic WebMail Lite 7
 AfterLogic Forum : AfterLogic WebMail Lite 7
Subject Topic: CPU overload Post ReplyPost New Topic
Author
Message << Prev Topic | Next Topic >>
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 23 January 2014 at 11:37pm | IP Logged Quote andlis
A month ago I noticed a strange problem. My CPU is overloaded sometimes. 25%, 50, 75, 100.. (4 cores) Normal load is 2-7%. It was easy to find that the problem is with httpd daemon. Right now I found the real reason.
/server-status:
Srv     PID     Acc     M     CPU      SS     Req     Conn     Child     Slot     Cl ient     VHost     Request
4-0     419     0/14/46436     W      0.16     59803     0     0.0     0.33     426 .14      188.123.245.145     myhost:80     GET /webmail/?/Raw/Download/18/NX2A8uN8wPzmg9ZHwTWFSoXW3snFrQxF

any ideas what is it? There is no /webmail/?/ of course..
Back to Top View andlis's Profile Search for other posts by andlis
 
Alex
AfterLogic Support
AfterLogic Support
Avatar

Joined: 19 November 2003
Online Status: Offline
Posts: 2207
Posted: 24 January 2014 at 3:06am | IP Logged Quote Alex
Quote:
any ideas what is it? There is no /webmail/?/ of course..

Couldn't understand this..

Regards,
Alex
Back to Top View Alex's Profile Search for other posts by Alex
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 24 January 2014 at 7:05am | IP Logged Quote andlis
some user waits to reply from the place, which is really absent in my system: "/webmail/?/Raw/Download/18/"
normally server should abort such connection, however it does not do it. So, webmail holds the connection (as seems to me). In this case it is a security bug.. What do you think?
Back to Top View andlis's Profile Search for other posts by andlis
 
Alex
AfterLogic Support
AfterLogic Support
Avatar

Joined: 19 November 2003
Online Status: Offline
Posts: 2207
Posted: 27 January 2014 at 6:44am | IP Logged Quote Alex
"/webmail/?/Raw/Download/18/" is /webmail" with "Raw/Download/18/" GET parameter.

It's the same as /webmail/index.php?/Raw/Download/18/.

Also, 0.16 does not seem to be large usage of the CPU. Spikes to 100% are possible but I guess you don't get 100% all the time?

Regads,
Alex
Back to Top View Alex's Profile Search for other posts by Alex
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 06 February 2014 at 7:41am | IP Logged Quote andlis
Now it is repeating, so I can continue.
/server-status:
5-0     24156     15/19/1833     W      1.43     1757     0     677.8     0.69     11 1.20      180.59.58.242     myhost:80     GET /webmail/?/Raw/View/14/HJo7EVbsvGUD_OFo6aX3HoPEH6I2NKdvWYP6

Well, really CPU load here is small. Now it is 1.43.
However look at the top results:
PID USER      PR NI VIRT RES SHR S %CPU %MEM    TIME+ COMMAND
24156 apache    20   0 471m 27m 6016 R 99,7 0,4 35:30.92 httpd

You see PID is 24156 in both cases. And CPU is 99.7%. And look at the time! So it hangs. And it will not stop untill I restart apache ((
Back to Top View andlis's Profile Search for other posts by andlis
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 06 February 2014 at 7:44am | IP Logged Quote andlis
By the way, that guys (180.59.58.242; 188.123.245.145) are not my users. So, is it a successful attack?
Back to Top View andlis's Profile Search for other posts by andlis
 
Igor
AfterLogic Support
AfterLogic Support


Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6167
Posted: 07 February 2014 at 2:01am | IP Logged Quote Igor
Without direct access to the system, it's not really possible for us to tell what exactly is going on. However, we have a suggestion regarding high CPU load - it might be caused by WebMail generating image previews, which fails for some reason on PHP level.

You can try disabling that feature by making a small modification in libraries/ProjectSeven/ActionsBase.php file, the following code:

Code:
private function isImageMimeTypeSuppoted($sMimeType)
{
    $bResult = function_exists('gd_info');


should be modified as follows:

Code:
private function isImageMimeTypeSuppoted($sMimeType)
{
    return false;
    $bResult = function_exists('gd_info');


Also, a configuration option will be added in upcoming version 7.2 to control this behavior.

Hope this helps!

--
Regards,
Igor, AfterLogic Support
Back to Top View Igor's Profile Search for other posts by Igor
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 08 February 2014 at 2:48am | IP Logged Quote andlis
Thank you very much! I'll try to use it. Unfortunately, last weeks this behaviour becomes rare.. So I can not analyse the result quickly.

Igor wrote:
Without direct access to the system, it's not really possible for us to tell what exactly is going on.

I can send a core dump.
Back to Top View andlis's Profile Search for other posts by andlis
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 06 March 2014 at 7:09am | IP Logged Quote andlis
So, I installed new version from this Feb. And disabled isImageMimeTypeSuppoted() as you wrote. No success. It starts again ((
I have a coredumps of hanging processes.
Or I can do anything to understand this behaviour. What, however?
Back to Top View andlis's Profile Search for other posts by andlis
 
Igor
AfterLogic Support
AfterLogic Support


Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6167
Posted: 06 March 2014 at 10:56pm | IP Logged Quote Igor
Actually, in current version thumbnails are disabled with the configuration option described here. So make sure they're actually disabled.

I don't think coredump will be much of a help here. What we need here is a reliable way to trigger the issue, it's just not possible to fix something we can't reproduce.

--
Regards,
Igor, AfterLogic Support
Back to Top View Igor's Profile Search for other posts by Igor
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 07 March 2014 at 5:32am | IP Logged Quote andlis
Well, I am trying )
Should I remove previous isImageMimeTypeSuppoted() disabling, or it does not matter?
Back to Top View andlis's Profile Search for other posts by andlis
 
Igor
AfterLogic Support
AfterLogic Support


Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6167
Posted: 07 March 2014 at 8:20am | IP Logged Quote Igor
I don't think removing it the old way would hurt, you can use both the ways just to be sure.

--
Regards,
Igor, AfterLogic Support
Back to Top View Igor's Profile Search for other posts by Igor
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 12 March 2014 at 1:10am | IP Logged Quote andlis
No, it starts again. So, let's look for another reason.
I see that the hanging processes originates from the same ip (((

And coredump
(gdb) frame 1
#1 0x00007f53e5fd50ea in _zval_dtor (zvalue=<optimized out>) at /usr/src/debug/php-5.4.23/Zend/zend_variables.h:35
35              _zval_dtor_func(zvalue ZEND_FILE_LINE_RELAY_CC);
(gdb) frame 2
#2 _zval_ptr_dtor (zval_ptr=0x7f53f772e018) at /usr/src/debug/php-5.4.23/Zend/zend_execute_API.c:436
436                             zval_dtor(*zval_ptr);
(gdb) frame 3
#3 _zval_ptr_dtor (zval_ptr=0x7f53f772e018) at /usr/src/debug/php-5.4.23/Zend/zend_execute_API.c:425
425     ZEND_API void _zval_ptr_dtor(zval **zval_ptr ZEND_FILE_LINE_DC) /* {{{ */
(gdb) frame 4
#4 0x00007f53e5ff1d68 in zend_hash_destroy (ht=0x7f53f772d7e0) at /usr/src/debug/php-5.4.23/Zend/zend_hash.c:560
560                             ht->pDestructor(q->pData);
(gdb) frame 5
#5 0x00007f53e5fda485 in destroy_op_array (op_array=0x7f53f772deb8) at /usr/src/debug/php-5.4.23/Zend/zend_opcode.c:352
352                     zend_hash_destroy(op_array->static_variables);
(gdb) frame 6
#6 0x00007f53e5ff1d68 in zend_hash_destroy (ht=0x7f53f7438688) at /usr/src/debug/php-5.4.23/Zend/zend_hash.c:560
560                             ht->pDestructor(q->pData);
(gdb) frame 7
#7 0x00007f53e5fda2dc in destroy_zend_class (pce=<optimized out>) at /usr/src/debug/php-5.4.23/Zend/zend_opcode.c:296
296                             zend_hash_destroy(&ce->function_table);
(gdb) frame 8
#8 0x00007f53e5ff1d68 in zend_hash_destroy (ht=0x7f53f72223c0) at /usr/src/debug/php-5.4.23/Zend/zend_hash.c:560
560                             ht->pDestructor(q->pData);
(gdb) frame 9
#9 0x00007f53e5fe3d0d in zend_shutdown () at /usr/src/debug/php-5.4.23/Zend/zend.c:823
823             zend_hash_destroy(GLOBAL_CLASS_TABLE);
(gdb) frame 10
#10 0x00007f53e5f855ab in php_module_shutdown () at /usr/src/debug/php-5.4.23/main/main.c:2375
2375            zend_shutdown(TSRMLS_C);
(gdb) frame 11
#11 0x00007f53e5f85669 in php_module_shutdown_wrapper (sapi_globals=<optimized out>) at /usr/src/debug/php-5.4.23/main/main.c:2343
2343            php_module_shutdown(TSRMLS_C);
(gdb) frame 12
#12 0x00007f53e608ce91 in php_apache_child_shutdown (tmp=<optimized out>) at /usr/src/debug/php-5.4.23/sapi/apache2handler/sapi_apache2.c:398
398             apache2_sapi_module.shutdown(&apache2_sapi_module);
(gdb) frame 13
#13 0x00007f53f3d6773e in run_cleanups (cref=<optimized out>) at memory/unix/apr_pools.c:2352
2352            (*c->plain_cleanup_fn)((void *)c->data);
(gdb) frame 14
#14 apr_pool_destroy (pool=0x7f53f76404e8) at memory/unix/apr_pools.c:814
814        run_cleanups(&pool->cleanups);

Requests are:
GET /webmail/?/Raw/Thumbnail/11/...
GET /webmail/?/Raw/Download/9/..
Back to Top View andlis's Profile Search for other posts by andlis
 
Igor
AfterLogic Support
AfterLogic Support


Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6167
Posted: 12 March 2014 at 1:55am | IP Logged Quote Igor
Code:
Requests are:
GET /webmail/?/Raw/Thumbnail/11/...


That particular request states that generating thumbnails was not disabled, they're still requested. Maybe there's something still in the cache somewhere.

--
Regards,
Igor, AfterLogic Support
Back to Top View Igor's Profile Search for other posts by Igor
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 12 March 2014 at 11:26pm | IP Logged Quote andlis
I am sorry. That type of request (Raw/Thumbnail) was before disabling. Now there is only Raw/Download.
And what is that function: under Raw/Download? Is it possible to disable it?
Back to Top View andlis's Profile Search for other posts by andlis
 
Igor
AfterLogic Support
AfterLogic Support


Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6167
Posted: 13 March 2014 at 2:28am | IP Logged Quote Igor
That request simply means that user downloaded attachment from email message. There's nothing wrong with that request so you shouldn't need to disable it.

--
Regards,
Igor, AfterLogic Support
Back to Top View Igor's Profile Search for other posts by Igor
 
marcele
Newbie
Newbie


Joined: 15 March 2014
Location: Canada
Online Status: Offline
Posts: 21
Posted: 15 March 2014 at 5:11am | IP Logged Quote marcele
We are seeing the exact same behavior using the latest afterlogic webmail lite (7.2.1).

Apache processes at 100% CPU with server status showing lots of requests:

afterlogic.webmail     GET /?/Raw/Download/42/RcY7r_jaXXcQElPop3HRc-DHaoJ-OIBGEnAW5nbI
afterlogic.webmail     GET /?/Raw/Download/226/NMeYfn8IGFwapJn1mHWbjDMx7Q7aID8qE2x7NdP
afterlogic.webmail     GET /?/Raw/Download/226/NMeYfn8IGFwapJn1mHWbjDMx7Q7aID8qE2x7NdP
afterlogic.webmail     GET /?/Raw/Download/42/RcY7r_jaXXcQElPop3HRc-DHaoJ-OIBGEnAW5nbI

The only way to fix it is to restart Apache.

Back to Top View marcele's Profile Search for other posts by marcele
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 21 April 2014 at 7:13am | IP Logged Quote andlis
I looked through a dozen of coredumps. It seems to me, the error is always caused by function
"partialParseResponseBranch"
in file
"/var/www/webmail/libraries/MailSo/Imap/ImapClient.php"
the result is
#8 0x00007f7a09753607 in execute (op_array=0x7f7a1a111898) at /usr/src/debug/php-5.4.23/Zend/zend_vm_execute.h:410
410                     if ((ret = OPLINE->handler(execute_data TSRMLS_CC)) > 0) {
Back to Top View andlis's Profile Search for other posts by andlis
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 22 April 2014 at 11:02pm | IP Logged Quote andlis
some addition
(gdb) print op_array.function_name
$1 = 0x7f7a1a1083e8 "ResetTimeLimit"
(gdb) print op_array.filename
$3 = 0x7f7a1a0e8de8 "/var/www/webmail/libraries/MailSo/Base/Utils.php"

What is the function ResetTimeLimit?
Can I change it to
public static function ResetTimeLimit(&$iTimer, $iTimeToReset = 15, $iTimeToAdd = 0)
for example?
Back to Top View andlis's Profile Search for other posts by andlis
 
Igor
AfterLogic Support
AfterLogic Support


Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6167
Posted: 24 April 2014 at 2:07am | IP Logged Quote Igor
That function prolongs time allowed for script to run using standard set_time_limit function of PHP. It resets execution time before sending a request with fgets. You can set it to 0 of course, but it might cause issues if single request takes too long.

--
Regards,
Igor, AfterLogic Support
Back to Top View Igor's Profile Search for other posts by Igor
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 24 April 2014 at 2:31am | IP Logged Quote andlis
Thanks.
So, I caught the guy who do it, right now. I have all kind of log activities. What do you need to understand what does he doing?
So it was not cycling or hanging. Some guy send requests sometimes. I want to understand how can he overload my cpu with webmail.
By the way, I cannot get user activity log from adminpanel: "Log file can't be read". How can I correct it?
Back to Top View andlis's Profile Search for other posts by andlis
 
Igor
AfterLogic Support
AfterLogic Support


Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6167
Posted: 24 April 2014 at 2:41am | IP Logged Quote Igor
We can look into this if you provide us with the logs, you can post those via HelpDesk. If the issue is limited to specific user account, login details of that account could help. Still the chances of finding a reason are rather slim, of course.

The "Log file can't be read" thing is usually about permissions, make sure the data directory is set recursively writable for web server.

--
Regards,
Igor, AfterLogic Support
Back to Top View Igor's Profile Search for other posts by Igor
 
andlis
Newbie
Newbie


Joined: 16 October 2013
Online Status: Offline
Posts: 29
Posted: 24 April 2014 at 3:02am | IP Logged Quote andlis
Well I posted. Thank you
No.. Data Directory is OK.. What is the name of user activity log file by Default?
Back to Top View andlis's Profile Search for other posts by andlis
 
Igor
AfterLogic Support
AfterLogic Support


Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6167
Posted: 24 April 2014 at 3:56am | IP Logged Quote Igor
The name looks like event-YYYY-MM-DD.txt and the pattern can be redefined in data/settings/config.php file. But in fact, looks like user activity logging was never implemented in version 7.*, I've notified the developers on this.

--
Regards,
Igor, AfterLogic Support
Back to Top View Igor's Profile Search for other posts by Igor
 
Niyi
Newbie
Newbie


Joined: 18 August 2014
Online Status: Offline
Posts: 6
Posted: 18 August 2014 at 6:20am | IP Logged Quote Niyi
Hello,

Was there a solution to this? I am also experiencing the same with the version 7.3
Back to Top View Niyi's Profile Search for other posts by Niyi
 

Page of 2 Next >>
  Post ReplyPost New Topic
Printable version Printable version

Forum Jump

Powered by Web Wiz Forums version 7.9
Copyright ©2001-2004 Web Wiz Guide