All sites unresponsive until reboot, happening a several times a day

[LeonardChallis]

OS CentOS 5.6 (Final)
Panel version 11.0.9 Update #61
The system is up-to-date; last checked at June 6, 2014 03:32 AM

I use pingdom to alert me when sites go down. It would happen only once every few weeks, and I'd just reboot the VPS from my provider's control panel, however in the last 24 hours it has started doing it more and more often. The only change I have made in this time is to delete a few unused web sites.

When I get alerted, I check the the domains and they won't load. I look at the plesk control panel page thought and that does work.

I can SSH in, but I can't see anything that might help in the messages log.

Can anyone suggest any good steps to begin looking in to this while I continue my searching around please?

Update: I removed the plesk control panel error as that only seemed to happen once and is not happening anymore.

Update 2: I saw quite a few entries in the /var/log/secure log and so I added iptables rules to only allow SSH access from my own IP and to DROP all other requests. It seemed fine for a while, but after 12 hours it has started becoming unresponsive again until reboot.

Any more suggestions?

 

[InderS]

Try to check : http://kb.parallels.com/en/119211

 

[LeonardChallis]

Thanks InderS, I have found that that specific problem was only resultant of the main problem though and it's not happening now. I am still getting the server crash and have to reboot often. I thought I could fix this with a service httpd restart, but it seems that even after that it fails too. I've updated my question a little.

 

[LeonardChallis]

I have installed fail2ban and activated the sshd (22) and httpd (80,443) jails in hope that it will catch the baddies in the act...

One question I have though, is will Plesk or Virtuozzo reset my iptables rules any time other than when I manually do it by resetting the firewall from the Virtuozzo control panel? The reason I ask is because I denied all SSHD access with a few rules in iptables, allowing only my IP to access it, however these have been lost somehow. If it does, then fail2ban could also be useless for any iptables rules it writes.

Please advise.

 

[InderS]

I will suggest you please try to setup SSH access allow list through /etc/hosts.allow and hosts.deny files so that you will not get any issues with the iptables.