Hi Snoity,

As per http://download.swsoft.com/virtuozzo/virtuozzo4.0/docs/en/lin/VzLinuxUBCMgmt/18778.htm:


It is not a surprise that your sites stop working when this limit is reached as this means that your VPS is out of memory to serve new requests. When oomguarpages is red, this means that the hard limit for it is reached and the kernel begins killing processes inside VPS to get some memory free. The yellow color means VPS is at the soft limit (or about to reach the hard limit). Although, this is not the limit but there are still too little memory for new processes to built up to serve services for new connections.

The issue with low memory is usually caused by two reasons: (1) your sites are very popular and require a lot of resources to serve so many clients; (2) you use some not-optimized scripts which consume more resources than it would be sufficient. The problem (1) can be solve by upgrade to a dedicated server only. The problem (2) can be solved by reviewing the coding of scripts you run and disabling the scripts you do not use. For the both issues, there is a temporary solution  to disable services you do not need on the server like, if you use it for www only, disabling email, POP3 and IMAP servers etc.

The settings on the both pictures look fine. As for the CPU, it is not being counted till your VPS starts using more CPU cycles than it is allowed for him to use without interruption for other VPS servers.

SMTP and POP3/IMAP need to run so your email address works. The only thing you can try to disable is smb service which is more than likely a SAMBA server that is required to interact with windows machines by providing and accessing windows shares, etc.

What Forum software are you using?  They can sometimes be resource hogs, and many times need performance tweaking.  Also, check your access logs for suspicious traffic, you might have bots hitting your forum trying to post SPAM.

I had a similar problem. (vBulletin)  And your forum software being up-to-date only means you have a better chance to stop the attacks from working, not stop them from using up resources during the failed attempts.

What I did to "fix" it was rename some of the file names the bots were trying to attack.

For example, I renamed "register.php" to "register2.php".  Now, the bots trying to access register.php got a 404 and no resources were used.

The idea is, your site has been targeted as a phpbb forum, and your receive attacks specifically designed to break into phpbb files.  By renaming the files to custom names, the bots don't know where forum files are. (although a more sophisticated bot could find them by crawling your site...but this solution assumes they don't do this.)

You'll have to also modify some template files so you don't have broken links throughout your forum, and it will cause issues with upgrading.... but it's a slight fix.

There are other more sophisticated scripts you can find out there to auto-block IPs that are being bad, but I haven't ever implemented any of them, so I can't comment on those.  I just know they are out there and in many different forms.

A file rename solution should help in the short term as you build a more sophisticated solution.

I don't have any add-ons on my forum and it's not that popular at all. It really sucks as I have no idea where this load-issue comes from. But anyway, I'm planning to get dedicated soon, and hopefully that will fix the problems. Will try the 'register' trick from conga first though.