Home / server / Questions / 826411
Accepted
AGamePlayer
Asked: 2017-01-16 07:18:06 +0800 CST

Why there are so many "ss" process on my server (CentOS with nginx serving the web)?

  • 772

There are about 500 concurrent users. It's because some famous people on social network repost a link.

This happened before. And our server were performing good.

But this time, the server is getting very slow and I noticed that the load is very high. In this picture the load is only 83.22 but that's because I rebooted it. Before rebooting it is 600+ (after editing this post, it's climbing to 200+, and it's still climbing, I guess it'd be above 600 soon)

I noticed that there're so many "ss" process. What are them? Any further advice on this case?

Thanks!

enter image description here

Update: after posting this question, it's getting higher:

enter image description here

Update:

I tried to find the source of this "ss" but it's like this:

enter image description here

Update: added another picture for ps auxw

Update:

Used ps aux | grep ss and listed this:

/bin/sh -c ss -nlp | grep "[,=]27846," || netstat -nlp | grep "[[:space:]]27846/"

enter image description here

high-load cpu-usage

2 Answers

  1. Best Answer

    Use ps auxw or ps -ef and look at parent process identifier (PPID) column.

    Both netstat and its successor ss are mainly used for monitoring. These are normal admin tools, not any background services. The behavior you see is not normal. I think PPID will lead you to whatever process is spawning these. (Except for a PPID of 1, which usually means the parent had already died.)

    • 3

  2. Your website must have some sort of 'current viewers' / 'current connections' hook that is causing it to call out to ss or netstat to get the # of network connections. This is a very heavy thing to do on each page load.

    • 1