server over load cpu/memory usage

[Secret Agent]

Please see two images attached. What's with spamassassin using all this overload?

This is a Dual Xeon 2.4GHz HT server (HP rackmount server) with 2GB ECC Buffered RAM.

It should handle this.

Specs:
cPanel / WHM 9.9.9 R-10
Dual Xeon 2.4GHz HT
2GB ECC RAM
Fedora Core 2

What's with the awstats overload, gzip and the httpd -DSL?

How do I control these?

Also, is it possible to remove awstats per domain? I could not find that.

[Secret Agent]

someone please help

[ewdi]

it's a known issue (gzip for apache is experiental in WHM) you might want to re-run WHM apache compile script and leave out gzip

[Secret Agent]

I went to update apache and clicked "load previous config" and gzip was not checked, meaning I never installed it. What could it be then?

I went to ssh root and did "locate gzip" and found these:

/bin/gzip/
/usr/bin/gzip
/usr/lib/python2.3/test/test_gzip.py
/usr/lib/python2.3/gzip.py
/usr/lib/python2.3/gzip.pyc
/usr/lib/python2.3/gzip.pyo
/usr/local/apache/libexec/mod_gzip.so

If this is the same gzip, how do I remove it?

[Secret Agent]

I ran top and got this:

13040 nobody    16   0 21408  13m  12m R 85.9  0.7   0:04.92 /usr/local/apache/bin/httpd -DSSL
22266 root      16   0  195m 186m 1388 R 60.1  9.2  38:40.32 /usr/sbin/grpck
16859 mysql     20   0 47228  33m 3756 R 17.8  1.6   0:00.55 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/server.domain.com.pid --skip
 6163 nobody    15   0 21232  13m  12m S 15.5  0.7   0:03.63 /usr/local/apache/bin/httpd -DSSL
 6149 nobody    16   0 22496  14m  12m S 14.5  0.7   0:05.25 /usr/local/apache/bin/httpd -DSSL
 6208 nobody    15   0 21392  13m  12m S 13.9  0.7   0:03.09 /usr/local/apache/bin/httpd -DSSL
22264 root      16   0  2380 1216 2200 R 13.2  0.1  11:16.05 /usr/bin/expect -- /scripts/grpck
 6142 nobody    15   0 21668  13m  12m S 10.3  0.7   0:06.02 /usr/local/apache/bin/httpd -DSSL
16827 mysql     17   0 47228  33m 3756 S  8.7  1.6   0:00.34 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/server.domain.com.pid --skip
 6170 nobody    15   0 21824  13m  12m S  8.1  0.7   0:05.07 /usr/local/apache/bin/httpd -DSSL
 6164 nobody    16   0 21416  13m  12m S  4.8  0.7   0:05.90 /usr/local/apache/bin/httpd -DSSL
 6938 root      15   0  2696  580 1300 D  4.5  0.0   5:39.53 syslogd -m 0
 6152 nobody    15   0 21748  13m  12m S  4.2  0.7   0:14.16 /usr/local/apache/bin/httpd -DSSL
 6132 nobody    15   0 21680  13m  12m S  3.2  0.7   0:04.01 /usr/local/apache/bin/httpd -DSSL

[Secret Agent]

ps -aux shows (heavy cpu lines inserted here only)

rivey1   18143 27.1  1.0 25140 21440 ?       S    00:55   0:02 /usr/bin/perl -T -w /usr/bin/spamassassin
root     22264 18.2  0.0  2380 1216 ?        S    Dec14  11:38 /usr/bin/expect -- /scripts/grpck
root     22266 62.8  9.1 200108 190672 pts/0 S    Dec14  40:07 /usr/sbin/grpck

User Domain %CPU %MEM Mysql Processes 
root  124.44 32.55 2.0 
Top Process %CPU 99.9 /usr/lib/gcc-lib/i386-redhat-linux/3.3.3/cc1 -quiet -Iext/standard/ -I/home/cpapachebuild/buildapache/php-4.3.9/ext/standard/ -I/home/cpapachebuild/buildapache/php-4.3.9/include -I/home/cpapachebuild/buildapache/php-4.3.9/main -I/home/cpapachebuild/buildapache/php-4.3.9 -I/home/cpapachebuild/buildapache/php-4.3.9/Zend -I/usr/kerberos/include -I/usr/X11R6/include -I/usr/include/freetype2 -I/usr/include/imap -I/home/cpapachebuild/buildapache/php-4.3.9/ext/mbstring/mbregex -I/home/cpapachebuild/buildapache/php-4.3.9/ext/mbstring/libmbfl -I/home/cpapachebuild/buildapache/php-4.3.9/ext/mbstring/libmbfl/mbfl -I/usr/local/flash/include -I/home/cpapachebuild/buildapache/php-4.3.9/ext/xml/expat -I/home/cpapachebuild/buildapache/php-4.3.9/TSRM -D__GNUC__3 -D__GNUC_MINOR__3 -D__GNUC_PATCHLEVEL__3 -DPHP_ATOM_INC -DPIC /home/cpapachebuild/buildapache/php-4.3.9/ext/standard/var.c -quiet -dumpbase var.c -auxbase-strip ext/standard/var lo -g -O2 -fPIC -o /tmp/ccVcLIkR.s 
Top Process %CPU 76.5 /usr/lib/gcc-lib/i386-redhat-linux/3.3.3/cc1 -quiet -Iext/openssl/ -I/home/cpapachebuild/buildapache/php-4.3.9/ext/openssl/ -I/home/cpapachebuild/buildapache/php-4.3.9/include -I/home/cpapachebuild/buildapache/php-4.3.9/main -I/home/cpapachebuild/buildapache/php-4.3.9 -I/home/cpapachebuild/buildapache/php-4.3.9/Zend -I/usr/kerberos/include -I/usr/X11R6/include -I/usr/include/freetype2 -I/usr/include/imap -I/home/cpapachebuild/buildapache/php-4.3.9/ext/mbstring/mbregex -I/home/cpapachebuild/buildapache/php-4.3.9/ext/mbstring/libmbfl -I/home/cpapachebuild/buildapache/php-4.3.9/ext/mbstring/libmbfl/mbfl -I/usr/local/flash/include -I/home/cpapachebuild/buildapache/php-4.3.9/ext/xml/expat -I/home/cpapachebuild/buildapache/php-4.3.9/TSRM -D__GNUC__3 -D__GNUC_MINOR__3 -D__GNUC_PATCHLEVEL__3 -DPHP_ATOM_INC /home/cpapachebuild/buildapache/php-4.3.9/ext/openssl/openssl.c -quiet -dumpbase openssl.c -auxbase-strip ext/openssl/openssl o -g -O2 -o /tmp/cctHAvvY.s 
Top Process %CPU 65.0 /usr/bin/perl -w /usr/bin/mrtg /etc/mrtg/mrtg.cfg 
mysql  71.80 26.83 0.0 
Top Process %CPU 99.9 /usr/sbin/mysqld --basedir/ --datadir/var/lib/mysql --usermysql --pid-file/var/lib/mysql/server.mydomain.com.pid --skip-locking --port3306 
Top Process %CPU 94.0 /usr/sbin/mysqld --basedir/ --datadir/var/lib/mysql --usermysql --pid-file/var/lib/mysql/server.mydomain.com.pid --skip-locking --port3306 
Top Process %CPU 69.0 /usr/sbin/mysqld --basedir/ --datadir/var/lib/mysql --usermysql --pid-file/var/lib/mysql/server.mydomain.com.pid --skip-locking --port3306

[Secret Agent]

Please help me here...now status shows these in red

User Domain %CPU %MEM Mysql Processes 
root  93.41 29.11 2.0 
Top Process %CPU 84.3 /usr/sbin/grpck 
Top Process %CPU 84.2 /usr/sbin/grpck 
Top Process %CPU 84.1 /usr/sbin/grpck 
mysql  42.00 22.34 0.0 
Top Process %CPU 99.9 /usr/sbin/mysqld --basedir/ --datadir/var/lib/mysql --usermysql --pid-file/var/lib/mysql/server.domain.com.pid --skip-locking --port3306 
Top Process %CPU 97.0 /usr/sbin/mysqld --basedir/ --datadir/var/lib/mysql --usermysql --pid-file/var/lib/mysql/server.domain.com.pid --skip-locking --port3306

Something is causing the process to load high.
I believe someone is also attempting to spam from my server.
Yesterday the load was about 17k in queue, deleted them all,
and then this mornign about 7k in qeueue, deleted them all. I checked now again
and about 1500 in queue. How do I track this down?

I ran chkrootkit and rkhunter, both fine.