The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Apache causing server crash

Discussion in 'EasyApache' started by KonokoHost, Mar 7, 2005.

  1. KonokoHost

    KonokoHost Member

    Joined:
    Mar 25, 2003
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Chino Hills, CA
    G'day

    Any help here is GREATLY appreciated. (and rewarded with cash upon them helping us out)

    Apache had been taking up a 99% (on average) CPU usage according to top. Now we notice the server keeps crashing. This has been happening since monday and we can not track the source.
    When pushing C in top to figure out the command, its just the apache binary with DSSL.

    I got the server back up and running and just need help in tracing the cause. This is a CPanel server with a rather small amount of sites on it (about 50 or s).
    I will respond with details if anyone asks for them.

    -randyc
     
  2. dalem

    dalem Well-Known Member
    PartnerNOC

    Joined:
    Oct 24, 2003
    Messages:
    2,577
    Likes Received:
    40
    Trophy Points:
    48
    Location:
    SLC
    cPanel Access Level:
    DataCenter Provider
    most likely you have proceess or script thats hanging find it and killl it and fix or remove it
    look through your http access logs to find out which one

    and turn keep alive off in httpd.conf might help
     
  3. KonokoHost

    KonokoHost Member

    Joined:
    Mar 25, 2003
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Chino Hills, CA
    I ran a netstat -na and found an ip with llike 40 different IP addresses.

    Using apf I've blocked it and now the load is down.

    Any preventative steps to this you would recommend?

    -randyc

    edit: we also shut off keepalive.
     
  4. jester.ro

    jester.ro Well-Known Member
    PartnerNOC

    Joined:
    Feb 6, 2004
    Messages:
    304
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Bucharest, Romania
    cPanel Access Level:
    DataCenter Provider
    what do you mean an IP with multiple ip addresses??
     
  5. KonokoHost

    KonokoHost Member

    Joined:
    Mar 25, 2003
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Chino Hills, CA
    my mistake, long day.


    I meant to say it was a single IP with quite a few connections. (A suspicious amount ;) )

    -randyc
     
  6. dalem

    dalem Well-Known Member
    PartnerNOC

    Joined:
    Oct 24, 2003
    Messages:
    2,577
    Likes Received:
    40
    Trophy Points:
    48
    Location:
    SLC
    cPanel Access Level:
    DataCenter Provider
    Mod_security :)

    Find out which site which webpage or script was being attacked
    as these attackers will realize the ip they wre using just got blocked and move to another (usally a Proxy)
     
    #6 dalem, Mar 7, 2005
    Last edited: Mar 7, 2005
Loading...

Share This Page