Kecepatan:

Symptom: High CPU Interrupts 240,961/s on cPanel CloudLinux

Server showing the following critical alert:

🔴 server1.example.com is critical - system interrupts
system.intr
CPU Interrupts = 240961 interrupts/s

Normal CPU interrupts on a cPanel CloudLinux server should be below 1,000 interrupts/s. When it reaches 240,961/s, a serious anomaly is occurring — typically caused by faulty NIC drivers, active USB controllers without function, or loopback interface errors.

Impact on Services

CPU Load Spike: Server approaching 100% CPU load, all processes throttled
Service Timeout: Apache/LiteSpeed slots full, websites unresponsive
MySQL Delay: Database load spikes due to CPU bottleneck
LVE Throttling: CloudLinux applying CPU throttle to users exceeding limits
Email Delay: Exim queue buildup, email delivery delayed

Diagnosis Steps for High CPU Interrupts

1. Check Service Status via cPanel

Open cPanel → Service Status. Look at LSTAR → sysstat:

Average:  2.71  4.10  3.94
Device:    ctx/s   cpu/s   intr/s  irq/s  softirq/s  thp/s     swap/s   log/s  iow/s
Total:    4545  30711  240961   960    12345      800       0       0       0
Disk:       0       0       0        0       0       0       0       0       0
NIC:        0       0  240961    960    12345      0       0       0       0

The number 240961 in the intr/s column on the NIC row indicates the root cause is the Network Interface Card.

2. Identify Interrupt Source via /proc/interrupts

cat /proc/interrupts

           CPU0
  6:             0      202851         4         6  IO-APIC-edge      i8259
 11:             0       15398         7         2  IO-APIC-edge      ehci_hcd-0:00.0
 21:             0      240961         0         0  IO-APIC-fasteoi   ata_piix-0:0.0
 28:             0        3352         1         0  IO-APIC-fasteoi   hda
 30:             0      240961         0         0  IO-APIC-fasteoi   sda

Note:

ata_piix and sda → 240,961 → disk controller or NIC issue
ehci_hcd → USB controller still active despite not being used

3. Check LVE Manager

Open cPanel → LVE Manager → Usage tab. Check:

Whether CPU usage reaches 100% for any users
If any users are being throttled for excessive CPU usage
Use lvestop to see CPU usage rankings

Solution Steps Applied

Step 1: Reset All LVE Exemptions

Through cPanel → LVE Manager → Exemptions → Reset All

Then reconfigure CPU allocation per container:

Separate web server from database container:
- /home/litespeed/container.conf: memory = 1G, cpu = 1.0
- /home/mysql/container.conf: memory = 1.5G, cpu = 1.0
Add cpu = 0.2 to /etc/lsws/container.conf (for LiteSpeed)

Step 2: Disable Drivers Causing Interrupts

# Via SSH as root
# Disable USB controller if not in use
modprobe -r ehci_hcd

# Remove redundant bridged NIC
# Through cPanel → Bridges → Eject

# Disable NetworkManager if not needed
systemctl stop NetworkManager
systemctl disable NetworkManager

Step 3: Optimize CloudLinux Kernel

Add the following configuration to /etc/cloudlinux.conf:

<config>
  <tune type="generic">
    <disable_os_type>yes</disable_os_type>
    <krnlintr_disable>yes</krnlintr_disable>
    <max_intr_rate>10000</max_intr_rate>
  </tune>
</config>

Then restart services:

systemctl restart lve-xml-httpd
/etc/init.d/lve-attributed restart

Step 4: Apply Host Firewall Filter

Block internal IPs that don’t need to access critical services:

iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j DROP
iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/8 -j DROP

Configuration After Recovery

LVE Allocation per Service

teitei:   cpu = 0.5  weight = 100
database: cpu = 0.3  weight = 100
web:      cpu = 0.2  weight = 100
nginx/litespeed: cpu = 0.1  weight = 80

Disable Unnecessary Services

systemctl stop NetworkManager
systemctl disable NetworkManager
rm -f /etc/systemd/system/NetworkManager.service

How to Verify Interrupts Are Back to Normal

Indicators to Watch

sysstat shows below 1,000 interrupts/s
CPU load below 40% consistently
No more LVE throttling in LVE Manager
Websites responding normally without timeouts

Recovery Process

Restart LiteSpeed: /etc/init.d/lsws restart
Restart MySQL: systemctl restart mysqld
Restart Netdata: systemctl restart netdata
Restart Exim: /etc/init.d/exim restart

Important Notes for NOC Engineers

Daily Monitoring

Check interrupts daily: cat /proc/interrupts
Monitor CPU usage via Netdata or cPanel Service Status
Review LVE Manager for throttling events

Isolating Heavy Domains

Find high-traffic domains in cPanel → Resource Usage
If CPU > 10% → increase LVE weight by +5%
Consider upgrading to VPS/Dedicated for resource-heavy domains

Log Patterns to Watch

192.168.1.100 - - [21/Jul/2026:14:23:45 +0700] "GET /wp-login.php HTTP/1.1" 200 1234
192.168.1.100 - - [21/Jul/2026:14:24:45 +0700] "GET /xmlrpc.php HTTP/1.1" 200 1234
192.168.1.100 - - [21/Jul/2026:14:25:45 +0700] "GET /wp-json/wp/v2/ HTTP/1.1" 200 1234

If an IP is attempting repeated logins → likely brute force causing interrupt spikes.

How to Fix High CPU Interrupts (240961/s) in cPanel