Apache crash - HTTPD failed - after server reached MaxClients

[Hostbox.be]

Hi guys,

problem on one of my servers.

Apache stops serving new clients after:
[error] server reached MaxClients setting, consider raising the MaxClients setting

BUT MaxClients is already at the maximum of 256. So after a restart of apache, within a couple of minutes, the 256 is reached.

When I do an Apache Status in WHM, I get a lot of readers like this ?

18-0 6133 0/0/1 R 0.00 44 920 0.0 0.00 0.06 ? ? ..reading..
19-0 6000 0/2/2 R 0.00 24 6 0.0 0.00 0.00 ? ? ..reading..
20-0 6010 0/3/3 R 0.44 24 234 0.0 0.10 0.10 ? ? ..reading..
21-0 6157 0/0/0 R 0.00 43 0 0.0 0.00 0.00 ? ? ..reading..
22-0 6012 0/5/5 R 0.00 24 0 0.0 0.01 0.01 ? ? ..reading..
23-0 6013 0/3/3 R 0.16 44 151 0.0 0.01 0.01 ? ? ..reading..
24-0 6014 0/6/6 R 0.12 24 14 0.0 0.09 0.09 ? ? ..reading..
25-0 6016 0/5/5 R 0.23 24 0 0.0 0.03 0.03 ? ? ..reading..
26-0 6017 0/3/3 R 3.07 24 0 0.0 0.04 0.04 ? ? ..reading..
27-0 6164 0/0/0 R 0.00 42 0 0.0 0.00 0.00 ? ? ..reading..

This is of course not normal. Is this a DDos attack ? Or something else ? What can I do now ? Where can I check or get more info on my server ?

Thanks for your help !

 

[AndyReed]

Apache stops serving new clients after:
[error] server reached MaxClients setting, consider raising the MaxClients setting

BUT MaxClients is already at the maximum of 256. So after a restart of apache, within a couple of minutes, the 256 is reached.

When I do an Apache Status in WHM, I get a lot of readers like this ?

18-0 6133 0/0/1 R 0.00 44 920 0.0 0.00 0.06 ? ? ..reading

It is likely to be a TCP Syn Flooding attack. If this is serious attack, software-based might help, but the best option is to put your server behind a hardware-based firewall such as: Cisco ASA 5500 series.