how to check virtual server logs over ssh

Hi. i have a virtual server that jumps up to 100% CPU for a day or 2 then goes back down to 5% at for the rest of the time.

i have been told that i can look at the message logs using ssh and i it will have some info on what is using the CPU.

I know how to log in to the virtual server with root access and cd into folders but where are the message logs stored and how do i download them when i find them?

i don't regard myself as a pro when it comes to ssh / command line please help! thanks.

server is running plesk version 9.5 (much out of date version)
centOS
LVL 1
helpchrisplzAsked:
Who is Participating?
 
goubunConnect With a Mentor Commented:
You run vi /ver/log/messages and it is : vi /var/log/messages
0
 
goubunCommented:
The file that have system logs is /var/log/messages you can see this with:

vi /var/log/messages or using WinSCP with the ssh credentials to download the file to your computer
0
 
jb1devCommented:
On RedHat based distros (like centos) you can typically find logs in /var/log

Without more information on what exact logs you are looking for, I can't be more specific.
0
Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
wimilesConnect With a Mentor Commented:
Hello,

If you have been running Plesk for a while, and have your stats turned on (Webalyzer or AWstats) then that is probably your culprit.  When your server is running at 100% CPU usage, try to SSH into it, and run the following command:

 top -c

This will list the processes that are using the most CPU on your server.  (q will quit out)

Once you have this information, I would suggest proceeding from there.  Once you know the process that is using your server so much, it will be easier to resolve the problem.
0
 
gheistCommented:
You need to install and enable psacct, then try to use lastcomm to detect what happens)
0
 
helpchrisplzAuthor Commented:
@goubun:
i just get a load or dashes in putty when i do:

 vi /ver/log/messages

~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
"/ver/log/messages" [New DIRECTORY]

and i think i was writing to the file? didnt know how to exit out of this so closed putty and logged in again.

@wimiles
if i use:
 top -c i can see the cpu usage for mysql apache and all the rest are called root. just not sure what i can do to fix the problem if i find that its apache thats using all the CPU. it doesn't tell me why. server isnt at 100% right now so waiting for this moment to happen.

so looking back at the logs method of doing things:

if i cd in to /var/log this is what i see.
 
[root@server***-***-**-*** ~]# cd /var/log
[root@server***-***-**-*** log]# pwd
/var/log
[root@server***-***-**-*** log]# ls
anaconda.log     cron       maillog.3     rkhunter.log.old  spooler.1
anaconda.syslog  cron.1     maillog.4     rpmpkgs           spooler.2
atmail           cron.2     mailman       rpmpkgs.1         spooler.3
audit            cron.3     messages      rpmpkgs.2         spooler.4
boot.log         cron.4     messages.1    rpmpkgs.3         sso
boot.log.1       dmesg      messages.2    rpmpkgs.4         sw-cp-server
boot.log.2       faillog    messages.3    sa                tallylog
boot.log.3       httpd      messages.4    samba             tomcat5
boot.log.4       kav        mysqld.log    secure            wtmp
brcm-iscsi.log   lastlog    pm            secure.1          wtmp.1
btmp             mail       ppp           secure.2          yum.log
btmp.1           maillog    prelink       secure.3          yum.log.1
conman           maillog.1  psa-horde     secure.4          yum.log.2
conman.old       maillog.2  rkhunter.log  spooler
[root@server***-***-**-*** log]#


@gheist
am not sure what  psacct is or how to even start using lastcomm.
0
 
helpchrisplzAuthor Commented:
what log is best to download and how can i download it using putty?
0
 
gheistCommented:
You have pscp in same directory
pscp user@server:/var/log/* c:\logs\
0
 
helpchrisplzAuthor Commented:
sorry for being a noob. I have used the following command in putty but dont see any thing in my computers c:\logs\ folder


[root@server***-***-**-*** log]# pscp user@server:/var/log/* c:\logs\
>
[root@server***-***-**-*** log]#

what am i doing wrong? thanks.

done this  also

[root@server***-***-**-*** log]# pscp root@server***-***-**-***:/var/log/* c:\logs\
>

but no joy
0
 
gheistConnect With a Mentor Commented:
Add -r parameter and remove * wildcard
0
 
helpchrisplzAuthor Commented:
so that would be:

pscp -r root@server***-***-**-***:/var/log/ c:\logs\

this correct?
0
 
gheistCommented:
idont know i dont use windows 95
0
 
helpchrisplzAuthor Commented:
ty
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.