Apache keeps crashing - Ton of "READING" requests

[fishfreek]

Something is afoot and I cant seem to find a log file to help me figure out whats going on. On a few of my servers today I have seen this. In the apache status section of WHM there are a TON of Reding requests enteries with no IP, Host or Vhost enteries. It just says ...reading...

The end result is apache keeps crashing.

[0utlier]

Yes... I've just noticed this on one server of mine. Anyone else?

[Stream]

My Apache just started crashing all the time a couple of hours ago. I'm only able to keep it up and running for 20-30 seconds before it crashes.

[fishfreek]

When I say a ton of reading requests I mean out of 150 apache status enteries 10-15 might be acutal requsts where its requesting or getting info and the balance are these reading reqests.

My guess is its some kind of massave DOS attack but how to stop/block it I am lost as I have yet to find a log file that has useful info.

I am running Apache/1.3.33 with ModSecurity/1.8.6-1.00RC2

[Myacen]

Having the same problem, I believe it's the easyapache on the server

[manokiss]

In many of our servers also, can someone from cPanel confirm this is not a daily upcp problem or something like that caused this?

Thank you!

[linux-image]

what does #ipcs on shell as root give u ?

[Stream]

This is what my error_log says over and over again:

[Mon Jan 24 17:50:36 2005] [notice] Accept mutex: sysvsem (Default: sysvsem)
[Mon Jan 24 17:50:53 2005] [error] server reached MaxClients setting, consider raising the MaxClients setting
[Mon Jan 24 17:53:54 2005] [notice] caught SIGTERM, shutting down
[Mon Jan 24 17:53:54 2005] [notice] Apache/1.3.33 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 PHP/4.3.10 FrontPage/5.0.2.2635 mod_ssl/2.8.22 OpenSSL/0.9.7a configured -- resuming normal operations
[Mon Jan 24 17:53:54 2005] [notice] suEXEC mechanism enabled (wrapper: /usr/local/apache/bin/suexec)
[Mon Jan 24 17:53:54 2005] [notice] Accept mutex: sysvsem (Default: sysvsem)
[Mon Jan 24 17:54:08 2005] [error] server reached MaxClients setting, consider raising the MaxClients setting

I have MaxClients set to 170 in httpd.conf and it's never been a problem before. Now the webserver stays up for just a couple of seconds before shutting down...

access_log says nothing interesting. What other log-files could I check?

[Myacen]

[Mon Jan 24 18:02:21 2005] [notice] caught SIGTERM, shutting down
[Mon Jan 24 18:02:22 2005] [warn] NameVirtualHost 67.18.234.47:80 has no VirtualHosts
[Mon Jan 24 18:02:22 2005] [warn] NameVirtualHost 67.18.234.21:80 has no VirtualHosts
[Mon Jan 24 18:02:22 2005] [warn] NameVirtualHost 67.18.234.9:80 has no VirtualHosts
[Mon Jan 24 18:02:22 2005] [warn] NameVirtualHost 67.18.234.15:80 has no VirtualHosts
[Mon Jan 24 18:02:22 2005] [warn] NameVirtualHost 67.18.234.13:80 has no VirtualHosts
[Mon Jan 24 18:02:22 2005] [warn] NameVirtualHost 67.18.234.13:80 has no VirtualHosts
[Mon Jan 24 18:02:22 2005] [warn] NameVirtualHost 67.18.234.13:80 has no VirtualHosts
[Mon Jan 24 18:02:22 2005] [warn] NameVirtualHost 67.18.234.13:80 has no VirtualHosts
[Mon Jan 24 18:02:22 2005] [warn] NameVirtualHost 67.18.234.7:80 has no VirtualHosts
[Mon Jan 24 18:02:22 2005] [warn] NameVirtualHost 67.18.234.7:80 has no VirtualHosts
[Mon Jan 24 18:02:22 2005] [warn] NameVirtualHost 67.18.234.7:80 has no VirtualHosts
[Mon Jan 24 18:02:22 2005] [notice] Apache configured -- resuming normal operations
[Mon Jan 24 18:02:22 2005] [notice] suEXEC mechanism enabled (wrapper: /usr/local/apache/bin/suexec)
[Mon Jan 24 18:02:22 2005] [notice] Accept mutex: sysvsem (Default: sysvsem)
[Mon Jan 24 18:02:29 2005] [error] [client 66.249.65.8] File does not exist: /home/hestonwe/public_html/robots.txt
[Mon Jan 24 18:02:29 2005] [error] [client 66.249.65.8] File does not exist: /home/hestonwe/public_html/404.shtml
[Mon Jan 24 18:02:31 2005] [error] [client 24.69.0.126] File does not exist: /home/coreylee/public_html/favicon.ico
[Mon Jan 24 18:02:31 2005] [error] [client 24.69.0.126] File does not exist: /home/coreylee/public_html/404.shtml
[Mon Jan 24 18:02:33 2005] [error] server reached MaxClients setting, consider raising the MaxClients setting

That's after a couple of seconds after starting up 4 servers having problems heh

[linux-image]

HTTPD (apache) will not start anymore!!!

and

teaking apache

might help.

[hunet]

Exactly the same thing happening here.

Doesn't look too good

[brainx]

We have the same problem here

[linux-image]

what version of cpanel are u guys running ? try switching to stable and try ?

[fishfreek]

My max clients was 150 and normal traffic on that server comes no where close to that. I upped it to 250 cause of this issue and its still having issues. I expect if I upped it to 500 the problem would STILL exist.

[timdorr]

My servers, as well. I originally started out by blocking IPs, but that's not working. So, as a very weak workaround, I have my crontab set up to restart apache every 2 minutes, thereby clearing the connection queue.