Hi.
I'm running Novell Linux SBS9 on a Dell PowerEdge 1750, 2 x 146Gb RAID-1 disks, 1Gb RAM.
So far the system has been really fast. However, on Thursday night last, the response became very slow. I went to the KDE console and it didn't react at all, although Groupwise mail seemed to be coming in and out of the server.
With no means of a clean reboot I had to hit the big 1/0 switch! The system came back as fast as usual, with GRUB bringing up all the usual goodies such as NFS, Tomcat4, Groupwise, etc., and then eDirectory which started OK and was status-checked OK. Then "Starting Apache" appeared. It stayed on the screen for at least 10 minutes. Finally, X started, along with the "spinning clock" cursor. The cursor, too, hung around for 15 minutes (normally 5 seconds) until the KDE log-in prompt finally arrived. I logged in as root then waited 20 minutes for each of the KDE components to get started.
And so on....
Somehow I managed to start a PuTTY SSH shell onto the system from my PC and tried a few commands. 'top' mostly works, and is showing 99.1% CPU idle, about 150Mb RAM free, no swap in use, and the disks are barely doing anything. 'ps', 'ls', 'cat', 'file' and other commands respond fine. Others, like 'man' (e.g. 'man ps') just don't respond, and clicking anything back on the main KDE console doesn't respond either (or will respond after 30 minutes).
I've already alluded to one clue above -- Apache. I decided to bring the system down again on Friday night. This time, Apache was stopped successfully, then eDirectory, other components, Groupwise, etc. Then "Stopping Tomcat4" appeared -- but it never stopped, so again I had to cut the power and reboot.
This means that the system is trying to run both Apache and Tomcat4 web servers. Groupwise Web Access needs a web server, but surely not two ? When booting, Tomcat4 comes up first, then later Apache (and the system suddenly becomes non-responsive). When going down, Apache stops OK but, later, the system appears to hang when stopping Tomcat4.
Is this 'two web server' situation likely to be causing such a big problem ? If no, how else do I begin to diagnose this lack of responsiveness ? I have also seen this server undergoing a couple of e-mail spoof attacks - perhaps it has a virus ?
