The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Apache problem

Discussion in 'EasyApache' started by ns1, Sep 25, 2007.

  1. ns1

    ns1 Active Member

    Joined:
    Aug 8, 2006
    Messages:
    31
    Likes Received:
    0
    Trophy Points:
    6
    1. I am a noob! So you have been warned :)

    I have:
    Cpanel 11 (recently updated to Stable) and Apache 1.3.39.
    WHM 11.2.0 cPanel 11.11.0-S16715
    CENTOS Enterprise 4.5 i686 - WHM X v3.1.0

    And for last few weeks, just after update to Cpanel11, I have a problem with HTTP.
    It seems that it goes into overload every now and then. And sometimes just HTTP doesn't work, so I have te restart it in WHM.

    Do you have any suggestions?
    I don't have many sites, and they are not that busy, except one forum that has about 400 unique visitors/day and cca 20Gb bandwith/month. But it worked ok so far.
    This is my configuration:
    Server P4 2.8GHz ValueLine
    RAM 512 MB RAM + 512Mb just upgrading...
    Primary HDD 80GB Hard Drive
    IP Addresses 5 IP Addresses
    Uplink Port Speed 10 Mbps Uplink

    Do you have any suggestions?

    Thank you...
     
  2. omenix

    omenix Active Member

    Joined:
    Aug 24, 2005
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    /dev/null
    Hi,

    Maybe you can tell more details about it here.. whats on the error log and is there any specific time your apache is down and so on..because I'm having the same problem like you lately and my error log always getting exit signal Segmentation fault (11) error message
     
  3. ns1

    ns1 Active Member

    Joined:
    Aug 8, 2006
    Messages:
    31
    Likes Received:
    0
    Trophy Points:
    6
    this is in my /var/log/messages

    Sep 25 15:15:35 new kernel: ** RABHIT ** IN=eth0 OUT= MAC=00:0d:61:36:af:17:00:14:6a:51:70:bf:08:00 SRC=85.104.150.91 DST=74.$
    Sep 25 16:01:01 new kernel: ** RABHIT ** IN=eth0 OUT= MAC=00:0d:61:36:af:17:00:14:6a:51:70:bf:08:00 SRC=91.125.150.199 DST=74$
    Sep 25 16:06:14 new kernel: ** RABHIT ** IN=eth0 OUT= MAC=00:0d:61:36:af:17:00:14:6a:51:70:bf:08:00 SRC=85.102.186.236 DST=74$
    Sep 25 16:30:25 new filelimits: Increasing file system limits succeeded
    Sep 25 16:37:05 new sshd(pam_unix)[5446]: session opened for user root by root(uid=0)
    Sep 25 16:49:20 new pure-ftpd: (?@75.37.249.77) [INFO] New connection from 75.37.249.77
    Sep 25 16:49:20 new last message repeated 4 times
    Sep 25 16:49:20 new pure-ftpd: (?@75.37.249.77) [INFO] Logout.
    Sep 25 16:49:20 new last message repeated 4 times
    Sep 25 17:29:22 new kernel: ** RABHIT ** IN=eth0 OUT= MAC=00:0d:61:36:af:17:00:14:6a:51:70:bf:08:00 SRC=59.95.186.41 DST=74.5$
    Sep 25 18:10:30 new kernel: ** RABHIT ** IN=eth0 OUT= MAC=00:0d:61:36:af:17:00:14:6a:51:70:bf:08:00 SRC=201.50.43.217 DST=74.$
    Sep 25 18:27:55 new named[4001]: client 62.42.230.5#1433: error sending response: host unreachable
    Sep 25 19:08:01 new kernel: ** RABHIT ** IN=eth0 OUT= MAC=00:0d:61:36:af:17:00:14:6a:51:70:bf:08:00 SRC=151.53.12.78 DST=74.5$
    Sep 25 19:11:05 new sshd(pam_unix)[1002]: session opened for user root by root(uid=0)
    Sep 25 19:15:06 new sshd(pam_unix)[1217]: session opened for user root by root(uid=0)


    i don't know if you wanted me to check on something else. please tell me where to look for it then... thx
     
  4. omenix

    omenix Active Member

    Joined:
    Aug 24, 2005
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    /dev/null
    how bout your httpd error logs the /var/log/messages wont tell you anything whats going on for the apache services
     
  5. koolcards

    koolcards Well-Known Member

    Joined:
    Oct 8, 2003
    Messages:
    146
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Tampa, Fl
    Those are firewall messages about blocked packets.

    The source of a packet blocked:
    SRC=201.50.43.217

    It's destination port:
    DST=74.$

    Check the configuration of whatever security/firewall software you have on there.
     
  6. ns1

    ns1 Active Member

    Joined:
    Aug 8, 2006
    Messages:
    31
    Likes Received:
    0
    Trophy Points:
    6
    well it started around 15:30, probably 15:15 judgeing by messages.

    What is this RABHIT process? and could it be that it is overloading my computer becouse i see a lot of it, almost every day?

    i found my error_log file... it's huge... is that normal?

    It has 100Mb!!!!!!

    part of error_log:

    [Tue Sep 25 15:14:50 2007] [error] [client 194.68.63.142] File does not exist: /home/levieyd/public_html/index.php
    [Tue Sep 25 15:14:50 2007] [error] [client 194.68.63.142] File does not exist: /home/levieyd/public_html/404.shtml
    [Tue Sep 25 15:14:54 2007] [error] [client 194.68.63.142] client denied by server configuration: /home/levieyd/public_html/_vti_cnf
    [Tue Sep 25 15:14:54 2007] [error] [client 194.68.63.142] client denied by server configuration: /home/levieyd/public_html/_vti_pvt
    [Tue Sep 25 15:14:54 2007] [error] [client 194.68.63.142] client denied by server configuration: /home/levieyd/public_html/_vti_log
    [Tue Sep 25 15:14:54 2007] [error] [client 194.68.63.142] client denied by server configuration: /home/levieyd/public_html/_vti_txt
    [Tue Sep 25 15:14:56 2007] [error] [client 89.164.154.13] File does not exist: /home/ivofan/public_html/eydis/style_images/eydisfolk/tile_sub-lite.gif
    [Tue Sep 25 15:14:56 2007] [error] [client 89.164.154.13] File does not exist: /home/ivofan/public_html/eydis/uploads/photo-19.gif
    [Tue Sep 25 15:14:56 2007] [error] [client 89.17.34.42] client denied by server configuration: /home/levieyd/public_html/_vti_cnf
    [Tue Sep 25 15:14:56 2007] [error] [client 89.17.34.42] client denied by server configuration: /home/levieyd/public_html/_vti_pvt
    [Tue Sep 25 15:14:56 2007] [error] [client 89.17.34.42] client denied by server configuration: /home/levieyd/public_html/_vti_log
    [Tue Sep 25 15:14:56 2007] [error] [client 89.17.34.42] client denied by server configuration: /home/levieyd/public_html/_vti_txt


    other parts are similar to this:

    [Tue Sep 25 15:15:06 2007] [error] [client 89.164.154.13] File does not exist: /home/ivofan/public_html/eydis/style_images/eydisfolk/tile_sub-lite.gif
    [Tue Sep 25 15:15:07 2007] [error] [client 89.164.154.13] File does not exist: /home/ivofan/public_html/eydis/style_images/eydisfolk/tile_sub-lite.gif
    [Tue Sep 25 15:15:10 2007] [error] [client 89.172.29.37] File does not exist: /home/ivofan/public_html/eydis/style_images/fortress/tile_sub-lite.gif
    [Tue Sep 25 15:15:10 2007] [error] [client 89.164.154.13] File does not exist: /home/ivofan/public_html/eydis/uploads/photo-19.gif
    [Tue Sep 25 15:15:20 2007] [error] [client 89.172.29.37] File does not exist: /home/ivofan/public_html/eydis/style_images/fortress/tile_sub-lite.gif
    [Tue Sep 25 15:15:20 2007] [error] [client 89.172.29.37] File does not exist: /home/ivofan/public_html/eydis/uploads/photo-19.gif
    [Tue Sep 25 15:15:22 2007] [error] [client 89.172.29.37] File does not exist: /home/ivofan/public_html/eydis/style_images/fortress/tile_sub-lite.gif
    [Tue Sep 25 15:15:22 2007] [error] [client 89.172.29.37] File does not exist: /home/ivofan/public_html/eydis/uploads/photo-19.gif
    [Tue Sep 25 15:15:24 2007] [error] [client 89.172.29.37] File does not exist: /home/ivofan/public_html/eydis/style_images/fortress/tile_sub-lite.gif
    [Tue Sep 25 15:15:26 2007] [error] [client 89.172.29.37] File does not exist: /home/ivofan/public_html/eydis/style_images/fortress/tile_sub-lite.gif
    [Tue Sep 25 15:15:26 2007] [error] [client 89.172.29.37] File does not exist: /home/ivofan/public_html/eydis/uploads/photo-19.gif
    [Tue Sep 25 15:15:27 2007] [error] [client 89.172.29.37] File does not exist: /home/ivofan/public_html/eydis/style_images/fortress/tile_sub-lite.gif
    [Tue Sep 25 15:15:27 2007] [error] [client 89.172.29.37] File does not exist: /home/ivofan/public_html/eydis/uploads/photo-19.gif


    or:

    [Tue Sep 25 15:15:33 2007] [error] [client 66.170.150.225] File does not exist: /home/grifon/public_html/_img/001_21.jpg
    [Tue Sep 25 15:15:33 2007] [error] [client 66.170.150.225] File does not exist: /home/grifon/public_html/404.shtml
    [Tue Sep 25 15:15:37 2007] [error] [client 66.170.150.225] File does not exist: /home/grifon/public_html/_img/001_21.jpg
    [Tue Sep 25 15:15:37 2007] [error] [client 66.170.150.225] File does not exist: /home/grifon/public_html/404.shtml
     
    #6 ns1, Sep 25, 2007
    Last edited: Sep 25, 2007
  7. koolcards

    koolcards Well-Known Member

    Joined:
    Oct 8, 2003
    Messages:
    146
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Tampa, Fl
    That "RABHIT" comes from a kernel process, I think your firewall, but is concatenated after the "74$" so can't really say EXACTLY what it is. Probably means something like "Aw S##T!" :eek:
    Did you check your security setup like I said?

    The rest of your logs are normal. "client denied by server configuration" means someone was trying to peek somewhere they aren't supposed to (that '/home/levieyd/public_html/_vti_cnf' directory).

    Where it says "File does not exist" means, uh, well, ... simply put, the File does not exist. ;)
     
  8. ns1

    ns1 Active Member

    Joined:
    Aug 8, 2006
    Messages:
    31
    Likes Received:
    0
    Trophy Points:
    6
    Erm, as i said I am new to all this.
    I have configured security by "A Beginner's Guide to Securing Your Server" that i found on this forum:
    http://forums.cpanel.net/showthread.php?t=30159

    then my firewall APF blocked some IP range and with it users... So finally I hired one company to fix that and optimize my server. And so they did.

    Where do i check my securtiy settings, and what do i look for?
     
  9. koolcards

    koolcards Well-Known Member

    Joined:
    Oct 8, 2003
    Messages:
    146
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Tampa, Fl
    New or not, go back to the company you've paid to optimize your server and ask them what the heck's going on. I have no idea what rulesets they've used but you may be able to see them in WHM's Main >> Security >> Security Center >> Host Access Control or you may have to examine the APF configuration file. I don't use it so I can't say.

    But, If I'd PAID someone to secure my server, you can bet I'd be asking them why I was having problems. :cool:
     
  10. ns1

    ns1 Active Member

    Joined:
    Aug 8, 2006
    Messages:
    31
    Likes Received:
    0
    Trophy Points:
    6
    well, after i upgraded my RAM seems to be working fine...
    The guys i paid did say that there was a high IOWAIT and that i should upgrade do SCSI, however RAM upgrade is much more quicker, needed, and low cost :)

    keep you posted...
     
  11. koolcards

    koolcards Well-Known Member

    Joined:
    Oct 8, 2003
    Messages:
    146
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Tampa, Fl
    SCSI upgrade huh? :eek:

    You did exactly the right thing in upgrading your RAM. Good luck. :D
     
  12. ns1

    ns1 Active Member

    Joined:
    Aug 8, 2006
    Messages:
    31
    Likes Received:
    0
    Trophy Points:
    6
    that was my reaction as well...

    still works :)
     
Loading...

Share This Page