Comprehensive Guide to Troubleshooting and Managing cPanel/Linux Server Issues

When your own Linux server slows down or a service stops, a short, fixed routine finds the cause faster than guessing: check load, memory, disk and failed services, then read the logs of whatever broke. This guide gives that routine with current commands for AlmaLinux, Rocky Linux and Ubuntu, plus notes for servers running a control panel such as cPanel/WHM, DirectAdmin or CyberPanel.

1. Load and CPU

nproc                      # number of CPU cores
uptime                     # load averages for 1, 5 and 15 minutes
top -c                     # live view; press P to sort by CPU, M by memory
ps aux --sort=-%cpu | head -15
ps -eo user,%cpu,%mem,cmd --sort=-%cpu | head -15   # which user

Read the load average against the core count. A load of 4 on a 4-core server means the CPUs are fully busy; well above that means work is queueing. On Linux, load also counts processes waiting for disk, so a high load with low CPU use in top usually points to slow storage (section 3), not to the processor.

htop is friendlier than top; install it with dnf install htop (from EPEL on AlmaLinux and Rocky) or apt install htop.

2. Memory and out-of-memory kills

free -h                    # look at the "available" column, not "free"
vmstat 1 5                 # si/so above 0 means the server is swapping
journalctl -k | grep -iE "out of memory|oom-kill|killed process"

Linux uses spare RAM as disk cache, so low "free" memory is normal. Trouble is low "available" memory, steady swapping, or OOM kills in the kernel log. When the OOM killer strikes, it usually picks the biggest process: MySQL, PHP-FPM or a Node.js app.

The usual fixes:

• Size PHP-FPM to your RAM. Set pm.max_children to roughly the memory you can give PHP divided by the size of one PHP process (check it with ps -o rss= -C php-fpm). Too high a value is what exhausts memory under load.
• Size MySQL's buffer pool to leave room for the web server and PHP. See MySQL performance optimisation.
• Add a small swap file as a safety net on small servers, not as a substitute for RAM.
• Move to a bigger plan when real usage has outgrown the server.

3. Disk space and disk I/O

df -h                      # space per filesystem
df -i                      # inodes: "no space left" can mean no inodes left
du -xh --max-depth=1 / 2>/dev/null | sort -h | tail -15
journalctl --disk-usage

A full / or /var breaks databases, mail and logins. Common culprits are old backups, log files that never rotate, the systemd journal and forgotten dumps in /root or /home. Cap the journal with journalctl --vacuum-size=500M, and check that logrotate covers your application logs.

For slow storage, install sysstat and look at utilisation and wait times:

iostat -x 2 5              # %util near 100 and high await = saturated disk
iotop -o                   # which processes are doing the I/O (needs root)
systemctl enable --now sysstat && sar -u    # history, once collection has run

4. Failed services and logs

systemctl --failed
systemctl status nginx     # or httpd, apache2, mariadb, mysqld, php-fpm
journalctl -u nginx -b --no-pager | tail -50
journalctl -p err -b       # every error since the last boot

Always test a web server's configuration before you restart it, so a typo doesn't take every site down:

The error Can't connect to local MySQL server through socket means the database isn't running or the socket path is wrong. Check systemctl status mariadb (or mysqld), read its log, and check free disk space before restarting it.

5. Network and DNS

ss -tulpn                  # which services listen on which ports
curl -sI https://example.com
dig +short example.com A   # does the domain point at this server's IP?
dig +short NS example.com  # which nameservers answer for it

If a site doesn't load, confirm that the domain points to your server, the service is listening, and the firewall allows the port. /etc/resolv.conf only controls which DNS resolver the server itself uses; it has nothing to do with where your domain points. For a site that won't resolve, see How to change your domain's DNS settings.

6. Security and firewall

• SSH: log in with keys, set PasswordAuthentication no, and use PermitRootLogin prohibit-password or a sudo user. Follow the SSH security hardening checklist.
• Firewall: use firewalld on AlmaLinux and Rocky, or ufw on Ubuntu, and open only the ports you use. See modern firewall management with nftables.
• Brute-force protection: fail2ban works on both families. Don't run two tools that both manage the firewall.
• CSF: its original developer stopped maintaining it in 2025. Existing installs keep working (csf -g IP finds a block, csf -dr IP removes a deny, csf -a IP allows an IP), but on a new server prefer firewalld or ufw. See diagnosing CSF IP blocks.
• Updates: apply security updates regularly with dnf upgrade or apt upgrade, and reboot when the kernel changes.

7. Servers running a control panel

A panel manages its own services, so use its tools rather than editing files it will overwrite.

On panel servers, change PHP versions, PHP-FPM pools and web server mode from the panel (WHM MultiPHP Manager, DirectAdmin CustomBuild, the CyberPanel interface), so your changes survive panel updates.

8. Running this on Domain India

Everything above applies to a VPS or server you manage. Our VPS is self-managed by default, with full root access and a choice of Linux distributions including Ubuntu, Debian, AlmaLinux and Rocky Linux. The VPS page lists free CyberPanel and optional DirectAdmin at ₹600 a month. We don't offer cPanel on VPS; for cPanel, use our shared cPanel hosting.

Prices on the cards are live and exclude 18% GST. Compare every plan on VPS servers, or read VPS vs shared hosting if you are not sure you need a server of your own.

Ready to take control of your own server? Compare VPS plans, harden it with the SSH security checklist, or open a ticket if you are unsure whether a VPS is right for you.