[SOLVED] Huge load on VDS web server, where to dig?

Question

CentOS

Good day.
I host sites on VDS hosting ruvds.
My first VDS, I don't really know what to write, so I'll write everything I know.
Characteristics - 2x2.2GHz, 1GB RAM, 20GB SSD, 1IP
OS - centOS 7, out of the box of the host. All settings are standard.
VestaCP control panel.
4 sites are hosted on CMS Drupal 7. Attendance is low. 3 sites, a total of about 100-200 people, and the fourth site 400-600. Those. the total attendance is not more than 800 people per day.
For half a year there was complete calm.
Since the beginning of May, I have encountered such a problem:

Hoster hinted that they need to increase power, switch to SSD and everything will be ok. Paid extra -> increased -> nothing has changed.
Then I turned off all the modules installed recently. Removed all CRON tasks on the server. 2 weekends were quiet. Today it started again, the screenshots are actually today's.
I look at server logs. Logs as logs. I don’t see anything super strange there (although I can look badly), I’m not sure that I know what exactly to look for there.
In general, the essence of the issue. What to look for and what it could be? Where to dig? The hoster is silent, says - your problems.
upd
Thank you all. Everything was very useless.
If someone is a noob like me and has encountered a similar one, this helped:
firstwiki.ru/index.php/%D0%9A%D1%80%D0%B0%D1%82%D0...
https: //xakep.ru/2009/10/14/49752/#toc01.
The curtain

Answer 1

Colored pictures are certainly beautiful, hints of technical support from the hosting provider are also somehow little informative and of little interest to anyone.
Yes, just like that, put the panel and everything. The server itself will not be configured.
A server with just installed VestaCP is a " bare " server, it is more expensive to place resources on it. Which you have probably already seen.
In general, logs to the studio!

Answer 2

Somehow too many ports stick out, you need to close and change port 22 to your own.
Port 3306 should definitely not stick around.
www.linuxjournal.su/ssh-dlya-prostyx-smertnyx-chast-2
https://rtfm.co.ua/linux-iptables-rukovodstvo-chas...
webhamster.ru/mytetrashare/index/mtb0/4088

Answer 3

Dns raised?
Was the ddos ​​on you or was your server doing a ddos ​​attack?