The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Apache keeps crashing..

Discussion in 'EasyApache' started by ChemicalWH, Jan 27, 2005.

  1. ChemicalWH

    ChemicalWH Active Member

    Joined:
    Mar 4, 2004
    Messages:
    40
    Likes Received:
    0
    Trophy Points:
    6
    Since 11 o clock this morning apache keeps crashing over and over again

    the apache status gives a lot of:
    2-1 26487 0/0/0 R 0.00 38 0 0.0 0.00 0.00 ? ? ..reading..
    3-1 26879 0/0/1 R 0.00 19 0 0.0 0.00 0.00 ? ? ..reading..
    4-1 26489 0/0/0 R 0.00 38 0 0.0 0.00 0.00 ? ? ..reading..
    5-1 26490 0/0/0 R 0.00 37 0 0.0 0.00 0.00 ? ? ..reading..
    6-1 26529 0/0/1 R 0.00 35 0 0.0 0.00 0.00 ? ? ..reading..
    7-1 26492 0/0/0 R 0.00 37 0 0.0 0.00 0.00 ? ? ..reading..
    8-1 26493 0/0/0 R 0.00 37 0 0.0 0.00 0.00 ? ? ..reading..
    9-1 26494 0/0/0 R 0.00 37 0 0.0 0.00 0.00 ? ? ..reading..
    10-1 26495 0/0/0 R 0.00 37 0 0.0 0.00 0.00 ? ? ..reading..

    The apache error log gives a lot of:
    [Thu Jan 27 10:51:22 2005] [warn] child process 11431 still did not exit, sending a SIGTERM
    [Thu Jan 27 10:51:22 2005] [warn] child process 11432 still did not exit, sending a SIGTERM
    [Thu Jan 27 10:51:22 2005] [warn] child process 11433 still did not exit, sending a SIGTERM
    [Thu Jan 27 10:51:22 2005] [warn] child process 11434 still did not exit, sending a SIGTERM
    [Thu Jan 27 10:51:22 2005] [warn] child process 11435 still did not exit, sending a SIGTERM

    and

    [Thu Jan 27 10:51:26 2005] [error] child process 11371 still did not exit, sending a SIGKILL
    [Thu Jan 27 10:51:26 2005] [error] child process 11372 still did not exit, sending a SIGKILL
    [Thu Jan 27 10:51:26 2005] [error] child process 11373 still did not exit, sending a SIGKILL
    [Thu Jan 27 10:51:26 2005] [error] child process 11374 still did not exit, sending a SIGKILL
    [Thu Jan 27 10:51:26 2005] [error] child process 11375 still did not exit, sending a SIGKILL
    [Thu Jan 27 10:51:26 2005] [error] child process 11376 still did not exit, sending a SIGKILL
    [Thu Jan 27 10:51:26 2005] [error] child process 11377 still did not exit, sending a SIGKILL


    I tried: increasing the amount of connections apache can handle
    Rebooting the system
    Updating apache

    i'm running:
    WHM 9.9.9 cPanel 9.9.9-S15
    Fedora i686 - WHM X v3.1.0

    Apache Core 1.3.33


    Any help would be appreciated..
     
  2. ChemicalWH

    ChemicalWH Active Member

    Joined:
    Mar 4, 2004
    Messages:
    40
    Likes Received:
    0
    Trophy Points:
    6
    I read the Ev1servers.net forum and saw someone fixed the problem by installing mod_dosevasive, so i did as well... hope it works.. iit hasn't happened since i installed it.. about 10 minutes ago :)

    i'll keep people here informed.. you never know if someone here will get the same problem.

    Ruud
     
  3. ChemicalWH

    ChemicalWH Active Member

    Joined:
    Mar 4, 2004
    Messages:
    40
    Likes Received:
    0
    Trophy Points:
    6
    dammit... doesnt make a difference at all..

    any more solutions ?
     
  4. bornonline

    bornonline Well-Known Member

    Joined:
    Nov 19, 2004
    Messages:
    139
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Earth
    Yeah...read this..
    Info
     
  5. moorer

    moorer Member

    Joined:
    Jan 27, 2005
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    1
    Yeah, that's a common problem in a lot of services. You can just "hold" a connection, and if you are not sending any GET requests, or even POST, anything at all, Apache will not log the visits. It will only log when the connection threads have been maxed out. There are not fixes for it that I know, I'm writing a firewall for my friend that works via SSH.

    [​IMG]


    It monitors the IP addresses connected via SSH and the netstat command. If a user has connected over so many times, on this example I showed it setup for 50, it will run IPTables and ban that IP.. Make sure to keep your netstat running live, so you can see this attack. It's very common, because it's so affective and hits apache so hard. I'm sure if someone knows bash scripting pretty well they can construct something that does exactly what I'm doing. Just run that constantly, you will have no problems.

    Keep in mind a connection to SQL via like PHP Nuke etc. use 10 - 15 connections at once. Anything over 40 is probably an attack of some sort.
     
Loading...

Share This Page