If you are sure that all your services apache/mysql/ are running just fine, you need to track the problem down.
Before you do anything:
# look at your network stats
netstat -a
#look at your tcp connections
netstat -tn
If you see a huge number of connections coming from one 1 IP than, most likely you are under attack. Copy that IP and do a reverse lookup
# get some info who this sucker is attacking from
dig -x IP
It is also a good idea to have server-status enabled for Apache so you can see at any time the number of processes running from apache.
# to ban the IP, go to .htaccess file and add this line to the end of file
deny from IP
Apache will through a forbiden error to any connection from that IP.
#restart your network
/sbin/service network restart
#restart apache
/sbin/service apache restart
This helps if you are under attack, but it doesn't help with misconfiguration of services. If netstats look good go to:
/var/log/ and explore your recent log files.
You need a firewall installed, SIM helps monitor services, and you need to monitor your machine for some time.
Also there are some really easy steps you need to take configuring TCP/IP in order to prevent several types of attack. Look at my /etc/sysctl.conf
QUOTE
[root@ensim phpacache]# cat /etc/sysctl.conf
# Disables packet forwarding
net.ipv4.ip_forward = 1
# Enables source route verification
net.ipv4.conf.all.rp_filter = 0
# Disables the magic-sysrq key
kernel.sysrq = 0
# Modify system limits for Ensim WEBppliance
fs.file-max = 65000
# Modify system limits for Ensim WEBppliance
fs.file-max = 65000
# Decrease the time default value for tcp_fin_timeout connection
net.ipv4.tcp_fin_timeout = 15
# Decrease the time default value for tcp_keepalive_time connection
net.ipv4.tcp_keepalive_time = 1800
# Turn off the tcp_window_scaling
net.ipv4.tcp_window_scaling = 0
# Turn off the tcp_sack
net.ipv4.tcp_sack = 0
# Turn off the tcp_timestamps
net.ipv4.tcp_timestamps = 0
# Enable TCP SYN Cookie Protection
net.ipv4.tcp_syncookies = 1
# Enable ignoring broadcasts request
net.ipv4.icmp_echo_ignore_broadcasts = 1
# Disable ICMP Redirect Acceptance
net.ipv4.conf.all.accept_redirects = 0
# Enable bad error message Protection
net.ipv4.icmp_ignore_bogus_error_responses = 1
# Log Spoofed Packets, Source Routed Packets, Redirect Packets
net.ipv4.conf.all.log_martians = 1
# Improve file system performance
vm.bdflush = 100 1200 128 512 15 5000 500 1884 2
# Improve virtual memory performance
vm.buffermem = 90 10 60
# Allowed local port range
net.ipv4.ip_local_port_range = 32768 61000
# Improve the number of open files
fs.file-max = 98304