Apache keeps crashing..

[ChemicalWH]

Since 11 o clock this morning apache keeps crashing over and over again

the apache status gives a lot of:
2-1 26487 0/0/0 R 0.00 38 0 0.0 0.00 0.00 ? ? ..reading..
3-1 26879 0/0/1 R 0.00 19 0 0.0 0.00 0.00 ? ? ..reading..
4-1 26489 0/0/0 R 0.00 38 0 0.0 0.00 0.00 ? ? ..reading..
5-1 26490 0/0/0 R 0.00 37 0 0.0 0.00 0.00 ? ? ..reading..
6-1 26529 0/0/1 R 0.00 35 0 0.0 0.00 0.00 ? ? ..reading..
7-1 26492 0/0/0 R 0.00 37 0 0.0 0.00 0.00 ? ? ..reading..
8-1 26493 0/0/0 R 0.00 37 0 0.0 0.00 0.00 ? ? ..reading..
9-1 26494 0/0/0 R 0.00 37 0 0.0 0.00 0.00 ? ? ..reading..
10-1 26495 0/0/0 R 0.00 37 0 0.0 0.00 0.00 ? ? ..reading..

The apache error log gives a lot of:
[Thu Jan 27 10:51:22 2005] [warn] child process 11431 still did not exit, sending a SIGTERM
[Thu Jan 27 10:51:22 2005] [warn] child process 11432 still did not exit, sending a SIGTERM
[Thu Jan 27 10:51:22 2005] [warn] child process 11433 still did not exit, sending a SIGTERM
[Thu Jan 27 10:51:22 2005] [warn] child process 11434 still did not exit, sending a SIGTERM
[Thu Jan 27 10:51:22 2005] [warn] child process 11435 still did not exit, sending a SIGTERM

and

[Thu Jan 27 10:51:26 2005] [error] child process 11371 still did not exit, sending a SIGKILL
[Thu Jan 27 10:51:26 2005] [error] child process 11372 still did not exit, sending a SIGKILL
[Thu Jan 27 10:51:26 2005] [error] child process 11373 still did not exit, sending a SIGKILL
[Thu Jan 27 10:51:26 2005] [error] child process 11374 still did not exit, sending a SIGKILL
[Thu Jan 27 10:51:26 2005] [error] child process 11375 still did not exit, sending a SIGKILL
[Thu Jan 27 10:51:26 2005] [error] child process 11376 still did not exit, sending a SIGKILL
[Thu Jan 27 10:51:26 2005] [error] child process 11377 still did not exit, sending a SIGKILL


I tried: increasing the amount of connections apache can handle
Rebooting the system
Updating apache

i'm running:
WHM 9.9.9 cPanel 9.9.9-S15
Fedora i686 - WHM X v3.1.0

Apache Core 1.3.33


Any help would be appreciated..

[ChemicalWH]

I read the Ev1servers.net forum and saw someone fixed the problem by installing mod_dosevasive, so i did as well... hope it works.. iit hasn't happened since i installed it.. about 10 minutes ago

i'll keep people here informed.. you never know if someone here will get the same problem.

Ruud

[ChemicalWH]

dammit... doesnt make a difference at all..

any more solutions ?

[bornonline]

Yeah...read this..
Info

[moorer]

Yeah, that's a common problem in a lot of services. You can just "hold" a connection, and if you are not sending any GET requests, or even POST, anything at all, Apache will not log the visits. It will only log when the connection threads have been maxed out. There are not fixes for it that I know, I'm writing a firewall for my friend that works via SSH.




It monitors the IP addresses connected via SSH and the netstat command. If a user has connected over so many times, on this example I showed it setup for 50, it will run IPTables and ban that IP.. Make sure to keep your netstat running live, so you can see this attack. It's very common, because it's so affective and hits apache so hard. I'm sure if someone knows bash scripting pretty well they can construct something that does exactly what I'm doing. Just run that constantly, you will have no problems.

Keep in mind a connection to SQL via like PHP Nuke etc. use 10 - 15 connections at once. Anything over 40 is probably an attack of some sort.