Apache Status Page showing ? & ..reading..

mm1250

Well-Known Member
Nov 10, 2006
108
0
166
What does it mean if I have serveral lines in my WHM apache status page that shows this:

Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request
4-0 28453 0/5/198 R 0.46 213 0 0.0 0.00 2.06 ? ? ..reading..
 

mm1250

Well-Known Member
Nov 10, 2006
108
0
166
Can anyone help? I have over 25 of these showing up in WHM apache status.
 

mm1250

Well-Known Member
Nov 10, 2006
108
0
166
Anyone plesae. I'm noticing they go away but only after 300seconds. And they seem to consume CPU/memory. I thought I read somewhere that it could be a DDOS attack but I not cannot find the article. Someone please help me. :(
 

Todd Mitchell

Well-Known Member
Staff member
Nov 13, 2006
301
1
243
Houston, TX
The multiple '..reading..' requests showing in apache status is evidence of a DoS attack. Use the command below to get a list of ip's connected to apache and the amount of connections each IP has. This will show you which ip's are attacking the server if any.

Code:
netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -n