The service “httpd” appears to be down

[Hays Sleiman]

Hello,

In the last few days, the httpd service has been going down a lot (7-15 times a day). The server has been up for months without issue so not sure what has caused it. And having a lot of ecommerce clients on there means it's a problem that needs to be solved asap.

Since this error is new to me and a quick Google shows each time is a different solution, I was hoping to get some help diagnosing this one.

I have csf installed but nothing has changed in the settings for months, so not sure if that's it. I've attached a copy of one of the emails which shows some details of the logs and this is what I've noticed:

- Primary IP: This IP is unusual to me. Is it something misconfigured or is it some internal IP used by WHM?
- In just about all the emails, a specific website has been always been in the "Top Processes" on more than one process. They say "php-fpm: pool website_com_au" but the CPU and Memory don't seem high enough to crash the httpd service. So is this normal? or should I look in to this account?
- This link seems to have a similar issue and it was solved but semaphores are new to me so not sure if this relates to me.

Any help would be greatly appreciated. Thank you.

 

[cPanelMichael]

Hello,

It looks like you may have attached the logs in PDF format in your initial post. Can you paste the specific error logs (without real domain names or IP addresses) in CODE tags?

Thank you.

 

[Hays Sleiman]

Server    ns1.myserver.com.au
Primary IP Address    10.1.0.5
Service Name    httpd
Service Status    failed ⛔
Notification    The service “httpd” appears to be down.
Service Check Method    The system failed to connect to this service’s TCP/IP port.
Reason    Service check failed to complete
Timeout while trying to get data from service: Died
Number of Restart Attempts    7
Startup Log    Mar 16 14:14:37 ns1.myserver.com.au systemd[1]: Starting Apache web server managed by cPanel EasyApache...
Mar 16 14:14:38 ns1.myserver.com.au systemd[1]: PID file /run/apache2/httpd.pid not readable (yet?) after start.
Mar 16 14:14:38 ns1.myserver.com.au systemd[1]: Started Apache web server managed by cPanel EasyApache.
Log Messages    [Fri Mar 16 15:26:18.230147 2018] [mpm_prefork:notice] [pid 1017] AH00163: Apache/2.4.29 (cPanel) OpenSSL/1.0.2n mod_bwlimited/1.4 configured -- resuming normal operations
[Fri Mar 16 15:21:17.117012 2018] [mpm_prefork:notice] [pid 1017] AH00163: Apache/2.4.29 (cPanel) OpenSSL/1.0.2n mod_bwlimited/1.4 configured -- resuming normal operations
[Fri Mar 16 15:16:15.799539 2018] [mpm_prefork:notice] [pid 1017] AH00163: Apache/2.4.29 (cPanel) OpenSSL/1.0.2n mod_bwlimited/1.4 configured -- resuming normal operations
Memory Information    Used    3.45 GB
Available    10.23 GB
Installed    13.69 GB

Load Information    0.88 0.92 0.98
Uptime    1 hour, 16 minutes, and 48 seconds
IOStat Information    avg-cpu: %user %nice %system %iowait %steal %idle 28.84 0.02 1.14 0.14 0.00 69.86 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn fd0 0.00 0.00 0.00 4 0 sda 20.08 607.39 65.85 2798665 303435 sdb 0.06 1.93 0.01 8885 52
Top Processes    PID    Owner    CPU %    Memory %    Command
7104    c150502a    30.31    0.46    php-fpm: pool domainA_com_au
7807    c160101a    24.24    0.15    php-fpm: pool domainB_com_au
7063    c150502a    23.91    0.46    php-fpm: pool domainA_com_au
7804    root    20.51    0.08    /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/bin/leechprotect
6285    c150502a    17.55    0.51    php-fpm: pool domainA_com_au

 

[cPanelMichael]

Hello,

Could you open a support ticket so we can take a closer look?

Create Support Ticket - Version 68 Documentation - cPanel Documentation

Thank you.

 

[Hays Sleiman]

The problem seems to have stopped by itself so I will keep an eye on it to see how it develops and if it happens again, I will open a ticket. Thank you.

 

[Hays Sleiman]

The error occurred again. I will open a support ticket.

 

[cPanelMichael]

Hello,

Feel free to post the ticket number here and we can update this thread with the outcome.

Thank you.

 

[Hays Sleiman]

The ticket number is 9401513.

The issue seems to be a server overload because of search engine bots' excessive crawling. This is just a guess and has not been confirmed but seems to fit in with what we're seeing in the logs.

I have added a robot.txt file and will see if the bots (specifically, the MJ12Bot) will obey. If not, I will block its IP completely.

I'll update this thread in a week or so when I've had a chance to see if the issue re-occurs.