Apache weird load

[urello]

Apache began to spawn a lot of children. Here is output of server status

Apache Server Status for 127.0.0.1

Server Version: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 mod_perl/2.0.6 Perl/v5.8.8
Server Built: Nov 14 2013 16:33:53

Current Time: Thursday, 14-May-2015 00:42:16 AWST
Restart Time: Thursday, 14-May-2015 00:37:23 AWST
Parent Server Generation: 143
Server uptime: 4 minutes 53 seconds
Total accesses: 1425 - Total Traffic: 60.4 MB
CPU Usage: u166.96 s8.42 cu198.42 cs0 - 128% CPU load
4.86 requests/sec - 211.0 kB/second - 43.4 kB/request
450 requests currently being processed, 0 idle workers

RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRRRRRRR
RR..............................................................

Scoreboard Key:
"_" Waiting for Connection, "S" Starting up, "R" Reading Request,
"W" Sending Reply, "K" Keepalive (read), "D" DNS Lookup,
"C" Closing connection, "L" Logging, "G" Gracefully finishing,
"I" Idle cleanup of worker, "." Open slot with no current process

Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request
0-143 538120 0/3/3 R 0.21 275 2909 0.0 0.01 0.01 ? ? ..reading..
1-143 538121 0/5/5 R 2.46 243 15 0.0 0.21 0.21 ? ? ..reading..
2-143 538122 0/2/2 R 0.13 272 501 0.0 0.01 0.01 ? ? ..reading..
3-143 538123 0/2/2 R 0.35 247 273 0.0 0.01 0.01 ? ? ..reading..
4-143 538124 0/3/3 R 0.75 264 163 0.0 0.00 0.00 ? ? ..reading..
5-143 538138 0/5/5 R 0.58 281 168 0.0 0.08 0.08 ? ? ..reading..
6-143 538154 0/3/3 R 0.68 287 2 0.0 0.11 0.11 ? ? ..reading..
7-143 538155 0/3/3 R 0.48 276 713 0.0 0.17 0.17 ? ? ..reading..
8-143 538189 0/3/3 R 0.28 245 6 0.0 0.09 0.09 ? ? ..reading..
9-143 538190 0/5/5 R 1.27 253 6 0.0 0.05 0.05 ? ? ..reading..
10-143 538191 0/4/4 R 1.09 284 485 0.0 0.02 0.02 ? ? ..reading..
11-143 538192 0/2/2 R 0.42 281 7 0.0 0.04 0.04 ? ? ..reading..
12-143 538215 0/1/1 R 0.02 268 293 0.0 0.01 0.01 ? ? ..reading..
13-143 538216 0/13/13 R 11.31 124 509 0.0 0.27 0.27 ? ? ..reading..
14-143 538217 0/1/1 R 0.03 285 318 0.0 0.00 0.00 ? ? ..reading..
15-143 538218 0/2/2 R 0.21 283 521 0.0 0.00 0.00 ? ? ..reading..
16-143 538219 0/1/1 R 0.03 271 325 0.0 0.00 0.00 ? ? ..reading..
17-143 538220 0/3/3 R 1.61 260 376 0.0 0.00 0.00 ? ? ..reading..
18-143 538221 0/2/2 R 0.36 254 681 0.0 0.00 0.00 ? ? ..reading..
19-143 538223 0/3/3 R 0.95 245 4 0.0 0.02 0.02 ? ? ..reading..
20-143 538251 0/0/0 R 0.00 277 0 0.0 0.00 0.00 ? ? ..reading..
21-143 538252 0/0/0 R 0.00 285 0 0.0 0.00 0.00 ? ? ..reading..
22-143 538253 0/0/0 R 0.00 285 0 0.0 0.00 0.00 ? ? ..reading..
23-143 538254 0/2/2 R 3.23 241 11 0.0 0.64 0.64 ? ? ..reading..
24-143 538255 0/1/1 R 0.17 245 7 0.0 0.00 0.00 ? ? ..reading..
25-143 538257 0/0/0 R 0.00 280 0 0.0 0.00 0.00 ? ? ..reading..
26-143 538258 0/2/2 R 1.00 264 5 0.0 0.00 0.00 ? ? ..reading..
27-143 538259 0/0/0 R 0.00 272 0 0.0 0.00 0.00 ? ? ..reading..
28-143 538260 0/0/0 R 0.00 275 0 0.0 0.00 0.00 ? ? ..reading..
29-143 538261 0/0/0 R 0.00 285 0 0.0 0.00 0.00 ? ? ..reading..
30-143 538262 0/1/1 R 1.05 232 8 0.0 0.02 0.02 ? ? ..reading..
31-143 538263 0/0/0 R 0.00 237 0 0.0 0.00 0.00 ? ? ..reading..
32-143 538264 0/0/0 R 0.00 273 0 0.0 0.00 0.00 ? ? ..reading..
33-143 538265 0/2/2 R 0.09 271 3577 0.0 0.02 0.02 ? ? ..reading..
34-143 538266 0/10/10 R 3.81 162 751 0.0 0.47 0.47 ? ? ..reading..
35-143 538267 0/1/1 R 0.01 258 349 0.0 0.00 0.00 ? ? ..reading..
36-143 538303 0/1/1 R 0.31 273 19 0.0 0.17 0.17 ? ? ..reading..
37-143 538304 0/1/1 R 0.05 246 448 0.0 0.03 0.03 ? ? ..reading..
38-143 538305 0/3/3 R 0.56 266 4 0.0 0.01 0.01 ? ? ..reading..
39-143 538306 0/1/1 R 0.16 259 464 0.0 0.00 0.00 ? ? ..reading..
40-143 538307 0/0/0 R 0.00 259 0 0.0 0.00 0.00 ? ? ..reading..
41-143 538308 0/0/0 R 0.00 273 0 0.0 0.00 0.00 ? ? ..reading..
42-143 538309 0/0/0 R 0.00 280 0 0.0 0.00 0.00 ? ? ..reading..
43-143 538310 0/0/0 R 0.00 248 0 0.0 0.00 0.00 ? ? ..reading..
44-143 538311 0/16/16 R 2.72 94 7 0.0 0.47 0.47 ? ? ..reading..
45-143 538312 0/15/15 R 3.33 163 3403 0.0 0.26 0.26 ? ? ..reading..
46-143 538313 0/61/61 R 11.59 34 4 0.0 2.61 2.61 ? ? ..reading..
47-143 538314 0/0/0 R 0.00 274 0 0.0 0.00 0.00 ? ? ..reading..

Could anyone advise what is that?

 

[cPanelMichael]

Hello,

There's an older thread where this is discussed:

https://forums.cpanel.net/threads/a...king-the-webpage-down-attack-going-on.229991/

Thank you.

 

[urello]

netstat -pan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -n |tail -1
503 203.170.87.121

203.170.87.121 - it is my own IP! I dont beleive that blocking my own IP will solve the issue

 

[cPanelMichael]

Hello,

Have you tried installing a firewall such as CSF to help block these types of requests automatically? You may want to consult with a qualified system administrator if the load continues to reduce the performance of your website.

Thank you.