Server unaccessible for 15 min every 24 hours

ℹ️ Support
1
Support intro

Sorry to hear you’re facing problems :slightly_frowning_face:

help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:

example

Or for longer, use three backticks above and below the code snippet:

longer
example
here

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Nextcloud version (eg, 20.0.5): 25.0.1
Operating system and version (eg, Ubuntu 20.04): Linux 5.15.75-gentoo x86_64
Apache or nginx version (eg, Apache 2.4.25): Apache 2.4.54-r2
PHP version (eg, 7.4): PHP-FPM 8.1.12

The issue you are facing:
For a few weeks now my server - which has been performing flawlessly for several years - becomes unresponsive for approx 15 minutes every evening at around the same time.
During that time, it is not possible to access the machine over the network. For example, trying to connect with ssh just does not react. It doesn’t time out, but it also does not connect.
As it is a hosted virtual server, there’s also no way to set up a terminal and access it locally.

Also any logging/monitoring breaks during that period. Once telegraf does send data again, the load15 value mostly is in a region of 100 (seems to vary to some degree from day to day).

image
image1512×568 48.5 KB

Usually I pretend to know my way around this PHP/Linux stuff, but here I’m currently out of ideas.
Any hints about what else to check would be greatly appreciated!

Is this the first time you’ve seen this error? (Y/N): No

Steps to replicate it:

  1. It happens without any specific user activity that I’m aware of.
  2. It happens every evening at 19:49 CET
  3. Wait 12-15 minutes and the server is back to normal.

The output of your Nextcloud log in Admin > Logging:

{"reqId":"Y4JtBEYTnUXOk21vqis17AAAABc","level":2,"time":"2022-11-26T19:46:12+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/daniel/inbox/","message":"Could not predict suspiciousness: No models found","userAgent":"macOS/12.6.1 (21G217) CalendarAgent/961.4.2","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"QTa0M6kJcjhQIawzo1Mx","level":2,"time":"2022-11-26T19:55:28+00:00","remoteAddr":"","user":"--","app":"news","method":"","url":"--","message":"http://feedproxy.google.com/PetaPixel read error : Client error: `GET http://feedproxy.google.com/PetaPixel` resulted in a `404 Not Found` response:\n<html lang=en><meta charset=utf-8><meta name=viewport content=\"initial-scale=1, minimum-scale=1, width=device-width\"><ti (truncated...)\n","userAgent":"--","version":"25.0.1.1","data":{"app":"news"}}
{"reqId":"Y4Jv-kYTnUXOk21vqis2ZQAADhc","level":2,"time":"2022-11-26T19:58:50+00:00","remoteAddr":"93.238.43.5","user":"ella","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/principals/users/ella/","message":"Could not predict suspiciousness: No models found","userAgent":"iOS/16.1.1 (20B101) remindd/1.0","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4Jv-zBnOWdbwJMpJFUVpwAATxA","level":2,"time":"2022-11-26T19:58:52+00:00","remoteAddr":"93.238.43.5","user":"ella","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/ella/","message":"Could not predict suspiciousness: No models found","userAgent":"iOS/16.1.1 (20B101) remindd/1.0","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JwD3L1YmOgDRWhVXUyGwABFhU","level":2,"time":"2022-11-26T19:59:12+00:00","remoteAddr":"93.238.43.5","user":"ella","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/principals/users/ella/","message":"Could not predict suspiciousness: No models found","userAgent":"iOS/16.1.1 (20B101) dataaccessd/1.0","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JwEDBnOWdbwJMpJFUVtQAAWBA","level":2,"time":"2022-11-26T19:59:13+00:00","remoteAddr":"93.238.43.5","user":"ella","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/principals/users/ella/","message":"Could not predict suspiciousness: No models found","userAgent":"iOS/16.1.1 (20B101) dataaccessd/1.0","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JwhkYTnUXOk21vqis2gAAAABg","level":2,"time":"2022-11-26T20:01:11+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/daniel/","message":"Could not predict suspiciousness: No models found","userAgent":"macOS/12.6.1 (21G217) CalendarAgent/961.4.2","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4Jwh0YTnUXOk21vqis2gQAAABY","level":2,"time":"2022-11-26T20:01:11+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/daniel/inbox/","message":"Could not predict suspiciousness: No models found","userAgent":"macOS/12.6.1 (21G217) CalendarAgent/961.4.2","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JwiEYTnUXOk21vqis2ggAAAAc","level":2,"time":"2022-11-26T20:01:12+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/daniel/inbox/","message":"Could not predict suspiciousness: No models found","userAgent":"macOS/12.6.1 (21G217) CalendarAgent/961.4.2","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JwuzBnOWdbwJMpJFUV_AAASRA","level":2,"time":"2022-11-26T20:02:04+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"POST","url":"/index.php/apps/bookmarks/public/rest/v2/lock","message":"Could not predict suspiciousness: No models found","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JwuzBnOWdbwJMpJFUV_AAASRA","level":2,"time":"2022-11-26T20:02:04+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"POST","url":"/index.php/apps/bookmarks/public/rest/v2/lock","message":"Could not predict suspiciousness: No models found","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JwvDBnOWdbwJMpJFUV_QAASBA","level":2,"time":"2022-11-26T20:02:05+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"GET","url":"/index.php/apps/bookmarks/public/rest/v2/folder/-1/hash","message":"Could not predict suspiciousness: No models found","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JwvDBnOWdbwJMpJFUV_QAASBA","level":2,"time":"2022-11-26T20:02:05+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"GET","url":"/index.php/apps/bookmarks/public/rest/v2/folder/-1/hash","message":"Could not predict suspiciousness: No models found","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JwvTBnOWdbwJMpJFUV_gAATxA","level":2,"time":"2022-11-26T20:02:06+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"GET","url":"/index.php/apps/bookmarks/public/rest/v2/folder/-1/hash","message":"Could not predict suspiciousness: No models found","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JwvjBnOWdbwJMpJFUV_wAAQxA","level":2,"time":"2022-11-26T20:02:06+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"DELETE","url":"/index.php/apps/bookmarks/public/rest/v2/lock","message":"Could not predict suspiciousness: No models found","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JwvjBnOWdbwJMpJFUV_wAAQxA","level":2,"time":"2022-11-26T20:02:07+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"DELETE","url":"/index.php/apps/bookmarks/public/rest/v2/lock","message":"Could not predict suspiciousness: No models found","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JyZ3L1YmOgDRWhVXUyuQABAAo","level":2,"time":"2022-11-26T20:09:11+00:00","remoteAddr":"176.198.201.84","user":"arno","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/arno/personal/","message":"Could not predict suspiciousness: No models found","userAgent":"DAVx5/4.2.4-gplay (2022/10/25; dav4jvm; okhttp/4.10.0) Android/12","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JyaXL1YmOgDRWhVXUyugABEgo","level":2,"time":"2022-11-26T20:09:13+00:00","remoteAddr":"176.198.201.84","user":"arno","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/arno/prchenkalender/","message":"Could not predict suspiciousness: No models found","userAgent":"DAVx5/4.2.4-gplay (2022/10/25; dav4jvm; okhttp/4.10.0) Android/12","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4JyanL1YmOgDRWhVXUyuwABEQo","level":2,"time":"2022-11-26T20:09:15+00:00","remoteAddr":"176.198.201.84","user":"arno","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/arno/contact_birthdays/","message":"Could not predict suspiciousness: No models found","userAgent":"DAVx5/4.2.4-gplay (2022/10/25; dav4jvm; okhttp/4.10.0) Android/12","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4J0HXL1YmOgDRWhVXUzFwAAAQo","level":2,"time":"2022-11-26T20:16:29+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/principals/users/daniel/","message":"Could not predict suspiciousness: No models found","userAgent":"macOS/12.6.1 (21G217) AddressBookCore/2498.5","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4J0HXL1YmOgDRWhVXUzGAAAAQg","level":2,"time":"2022-11-26T20:16:30+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/daniel/","message":"Could not predict suspiciousness: No models found","userAgent":"macOS/12.6.1 (21G217) AddressBookCore/2498.5","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4J0HjBnOWdbwJMpJFUXNwAAAFM","level":2,"time":"2022-11-26T20:16:31+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/addressbooks/users/daniel/","message":"Could not predict suspiciousness: No models found","userAgent":"macOS/12.6.1 (21G217) AddressBookCore/2498.5","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4J0HzBnOWdbwJMpJFUXOAAAAEA","level":2,"time":"2022-11-26T20:16:31+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/addressbooks/users/daniel/contacts/","message":"Could not predict suspiciousness: No models found","userAgent":"macOS/12.6.1 (21G217) AddressBookCore/2498.5","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4J0Z3L1YmOgDRWhVXUzTAAAAQo","level":2,"time":"2022-11-26T20:17:43+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/daniel/","message":"Could not predict suspiciousness: No models found","userAgent":"macOS/12.6.1 (21G217) CalendarAgent/961.4.2","version":"25.0.1.1","data":{"app":"suspicious_login"}}
{"reqId":"Y4J0aHL1YmOgDRWhVXUzTQAAAQg","level":2,"time":"2022-11-26T20:17:44+00:00","remoteAddr":"93.238.43.5","user":"daniel","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/daniel/inbox/","message":"Could not predict suspiciousness: No models found","userAgent":"macOS/12.6.1 (21G217) CalendarAgent/961.4.2","version":"25.0.1.1","data":{"app":"suspicious_login"}}

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

$CONFIG = array (
  'passwordsalt' => 'xyzXYZ',
  'secret' => 'xyzXYZ',
  'trusted_domains' => 
  array (
    0 => 'nextcloud.xyzXYZ.net',
  ),
  'datadirectory' => '/home/nextcloud-data',
  'overwrite.cli.url' => 'http://nextcloud.xyzXYZ.net',
  'htaccess.RewriteBase' => '/',
  'dbtype' => 'pgsql',
  'version' => '25.0.1.1',
  'dbname' => 'nextquelle',
  'dbhost' => 'localhost',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'dbuser' => 'myxyzXYZ',
  'dbpassword' => 'xyzXYZ',
  'installed' => true,
  'instanceid' => 'xyzXYZ',
  'mail_smtpmode' => 'smtp',
  'mail_smtpauthtype' => 'PLAIN',
  'mail_from_address' => 'nextcloud',
  'mail_domain' => 'xyzXYZ.net',
  'mail_smtphost' => 'mail.xyzXYZ.net',
  'mail_smtpport' => '25',
  'mail_smtpauth' => 1,
  'mail_smtpname' => 'owncloud@xyzXYZ.net',
  'mail_smtppassword' => 'xyzXYZ',
  'maintenance' => false,
  'theme' => '',
  'default_phone_region' => 'DE',
  'loglevel' => 2,
  'log_rotate_size' => 10485760,
  'updater.release.channel' => 'stable',
  'memcache.local' => '\\OC\\Memcache\\Redis',
  'filelocking.enabled' => 'true',
  'memcache.distributed' => '\\OC\\Memcache\\Redis',
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'redis' => 
  array (
    'host' => 'localhost',
    'port' => 6379,
    'timeout' => 0,
    'dbindex' => 0,
  ),
  'mail_sendmailmode' => 'smtp',
);

The output of your Apache/nginx/system log in /var/log/nextcloud.access.log:
(This is a PHP-FPM access log file)

127.0.0.1 - daniel 26/Nov/2022:19:47:43 +0100 "GET /ocs/v2.php?format=json" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 81.434 6144 49
.12%
127.0.0.1 - daniel 26/Nov/2022:19:47:43 +0100 "PROPFIND /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 90.511 6144 66.29%
127.0.0.1 - daniel 26/Nov/2022:19:48:13 +0100 "PROPFIND /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 92.965 6144 75.30%
127.0.0.1 -  26/Nov/2022:19:48:33 +0100 "GET /ocs/v2.php" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 1487858.210 6144 0.01%
127.0.0.1 - daniel 26/Nov/2022:19:48:43 +0100 "GET /ocs/v2.php?format=json" 200 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 1477690.531 61
44 0.01%
127.0.0.1 - daniel 26/Nov/2022:19:48:43 +0100 "GET /ocs/v2.php?format=json" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 1477880.074 61
44 0.01%
127.0.0.1 - daniel 26/Nov/2022:19:48:43 +0100 "PROPFIND /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 1477877.039 6144 0.01
%
127.0.0.1 - daniel 26/Nov/2022:19:49:43 +0100 "GET /ocs/v2.php?format=json" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 1418044.560 61
44 0.00%
127.0.0.1 -  26/Nov/2022:19:53:31 +0100 "GET /ocs/v2.php" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 1189717.181 6144 0.05%
127.0.0.1 - daniel 26/Nov/2022:19:49:51 +0100 "PROPFIND /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 1410244.390 6144 0.01%
127.0.0.1 -  26/Nov/2022:20:13:17 +0100 "GET /ocs/v2.php" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 4163.000 6144 16.81%
127.0.0.1 -  26/Nov/2022:19:52:32 +0100 "GET /ocs/v2.php" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 1250410.651 6144 0.05%
127.0.0.1 - daniel 26/Nov/2022:20:13:17 +0100 "PROPFIND /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 4823.701 6144 9.95%
127.0.0.1 -  26/Nov/2022:19:48:58 +0100 "PUT /ocs/v2.php?format=json" 200 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 1464409.237 6144 0.04%
127.0.0.1 -  26/Nov/2022:20:13:18 +0100 "GET /ocs/v2.php" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 4868.154 6144 9.45%
127.0.0.1 -  26/Nov/2022:20:13:17 +0100 "GET /ocs/v2.php" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 6097.368 6144 8.36%
127.0.0.1 - daniel 26/Nov/2022:20:14:03 +0100 "POST /index.php" 200 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/index.php 996.085 8192 83.33%
127.0.0.1 - daniel 26/Nov/2022:20:14:04 +0100 "GET /index.php" 200 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/index.php 860.279 8192 83.69%
127.0.0.1 - daniel 26/Nov/2022:20:14:05 +0100 "GET /index.php" 200 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/index.php 871.077 8192 82.66%
127.0.0.1 - daniel 26/Nov/2022:20:14:06 +0100 "DELETE /index.php" 200 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/index.php 829.335 8192 84.40%
127.0.0.1 -  26/Nov/2022:20:14:29 +0100 "PUT /ocs/v2.php?format=json" 200 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 77.277 6144 64.70%
127.0.0.1 -  26/Nov/2022:20:14:38 +0100 "GET /ocs/v2.php" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 75.739 6144 79.22%
127.0.0.1 -  26/Nov/2022:20:14:58 +0100 "REPORT /remote.php" 401 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 68.378 6144 73.12%
127.0.0.1 - ella 26/Nov/2022:20:14:58 +0100 "REPORT /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 447.062 6144 85.00%
127.0.0.1 -  26/Nov/2022:20:14:59 +0100 "PROPFIND /remote.php" 401 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 47.835 6144 83.62%
127.0.0.1 - ella 26/Nov/2022:20:14:59 +0100 "PROPFIND /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 407.858 6144 88.27%
127.0.0.1 -  26/Nov/2022:20:15:00 +0100 "PROPFIND /remote.php" 401 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 51.151 6144 58.65%
127.0.0.1 - ella 26/Nov/2022:20:15:00 +0100 "PROPFIND /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 411.129 6144 90.00%
127.0.0.1 -  26/Nov/2022:20:15:00 +0100 "PROPFIND /remote.php" 401 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 136.376 6144 36.66%
127.0.0.1 - ella 26/Nov/2022:20:15:00 +0100 "PROPFIND /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 430.512 6144 88.27%
127.0.0.1 -  26/Nov/2022:20:15:02 +0100 "REPORT /remote.php" 401 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 58.023 6144 86.17%
127.0.0.1 - ella 26/Nov/2022:20:15:02 +0100 "REPORT /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 410.512 6144 87.70%
127.0.0.1 -  26/Nov/2022:20:15:02 +0100 "PROPFIND /remote.php" 401 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 41.561 6144 48.12%
127.0.0.1 - ella 26/Nov/2022:20:15:02 +0100 "PROPFIND /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 418.362 6144 88.44%
127.0.0.1 -  26/Nov/2022:20:15:09 +0100 "GET /ocs/v2.php" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 65.158 6144 92.08%
127.0.0.1 -  26/Nov/2022:20:15:39 +0100 "GET /ocs/v2.php" 304 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/ocs/v2.php 116.305 6144 68.78%
127.0.0.1 -  26/Nov/2022:20:15:53 +0100 "OPTIONS /remote.php" 401 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 69.690 6144 86.10%
127.0.0.1 - daniel 26/Nov/2022:20:15:54 +0100 "OPTIONS /remote.php" 200 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 513.203 6144 81.84%
127.0.0.1 - daniel 26/Nov/2022:20:15:54 +0100 "PROPFIND /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 460.923 6144 84.61%
127.0.0.1 -  26/Nov/2022:20:15:55 +0100 "PROPFIND /remote.php" 401 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 67.124 6144 89.39%
127.0.0.1 - daniel 26/Nov/2022:20:15:55 +0100 "PROPFIND /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 492.622 6144 83.23%
127.0.0.1 - daniel 26/Nov/2022:20:15:55 +0100 "REPORT /remote.php" 207 /var/www/xyzXYZ.net/subdomains/nextcloud/htdocs/remote.php 480.350 6144 83.27%

The value after the processed URL is the execution time in ms. See the lines starting at 19:48:33


Output errors in nextcloud.log in /var/www/ or as admin user in top right menu, filtering for errors. Use a pastebin service if necessary.

No errors in nextcloud.log

Thanks and regards
Daniel

2

Hello @danielg ,

welcome to the community of Nextcloud.

I am sure your issue is not related to nextcloud because Nextcloud is just a web service offered by your webserver.

Have you checked cron jobs?
I would also recommend to check your system for malware or any other suspicious software.

3

So you have syslogs during this period? Can you still ping it?

4

Pinging is disabled by iptables rules. But I could probably revert that temporarily.
The syslog (interestingly) shows a few postfix auth errors during that period, though these happen around the clock. It’s interesting because most other logging really is broken while the load is high.

rkhunter runs every night on the system and there haven’t been changes in the results as long as I monitor it.
Cron jobs don’t seem to run at that time and other suspicious activity at least is not obvious. (yes, this is usually the point of it…)

I’ll keep looking. As I said, any ideas where to look are welcome.

5

Updates, backup routines, snapshotting with freezing, heavy cron jobs. It does not sound as an issue with your Nextcloud instance but more like a host thing.

1 Like
6

Hi everyone,

after a while I can finally provide an update: Kerasit actually gave an interesting hint.
As the server is a hosted VM, I contacted the hosting provider. Today they moved my VM to a different host and the issue is gone.

While the server was unavailable, my VM showed almost 100% iowait. Without the possibility to diagnose this in more detail, I assume some other VM on the same host may have caused this.

So thanks to anyone who read it and gave it some thought, but it looks like Nextcloud is not to blame.

Regards
Daniel

1 Like