(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80

[Highway]

Hello,

Since 2 days have I an big problem.
Every 2 - 4 hours, apache will stop working.

When i type: /etc/init.d/httpd restart it says:

(98)Address already in use: make_sock: could not bind to address [::]:80
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down

I have the same problem on another DirectAdmin server, but on that server stops apache in one time in the 2 weeks.

Have anyone had the same problems? And how to solve it? I've googled, but found not much.

OS CentOS 5, apache 2.2.

Thanks in advantage!

Regards,
Highway.

[smtalk]

Please post the output of:

netstat -lnp | grep :80

[Highway]

Hi Smtalk,

Thanks for your answer. When apache is stoped again, I post here the output.
I've done this previously, but I can't remember me any special on port 80.

Kind Regards,
Highway

[xantini]

I have the same problem and i get this output

[root@server b]# netstat -lnp | grep :80
tcp 0 0 :::80 :::* LISTEN 15576/ns.pl

Thanks for all help

Best regards from Morten Buljo

[Highway]

I have the same problem and i get this output

[root@server b]# netstat -lnp | grep :80
tcp 0 0 :::80 :::* LISTEN 15576/ns.pl

Thanks for all help

Best regards from Morten Buljo

Try killall -9 ns.pl

Does'nt work that, please run: updatedb and then give the output from:

locate ns.pl

ns.pl is'nt present on my server, with locate the server tell's you what ns.pl's path is.

[xantini]

I kill all and restart httpd and it working now, but what cause the problem ? so we can fix the problem

[Highway]

I kill all and restart httpd and it working now, but what cause the problem ? so we can fix the problem

I don't know at this time.
Apache is on my server stoped now.

[root ~]# netstat -lnp | grep :80
tcp 0 0 :::80 :::* LISTEN 13481/hugobloc.pl

So on your and my server both an pl script.

Edit: I do now an updatedb, so I can check where it come from. This take a while, time for coffee.

Edit 2: It founds nothing!? :s

[xantini]

I try to restart my httpd and get this message

[root@server p247com]# /sbin/service httpd restart
Stopping httpd: [ OK ]
Starting httpd: [Sun Nov 01 19:43:28 2009] [warn] module php5_module is already loaded, skipping
(98)Address already in use: make_sock: could not bind to address [::]:80
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs

[root@server p247com]# /sbin/service httpd restart
Stopping httpd: [FAILED]
Starting httpd: [Sun Nov 01 19:43:43 2009] [warn] module php5_module is already loaded, skipping
(98)Address already in use: make_sock: could not bind to address [::]:80
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs

[root@server p247com]# netstat -lnp | grep :80
tcp 0 0 :::80 :::* LISTEN 12839/ixko.pl



EDIT

[root@server /]# netstat -lnp | grep :80
tcp 0 0 :::80 :::* LISTEN 12840/ixko.pl
[root@server /]# kill -9 12840
[root@server /]# netstat -lnp | grep :80
tcp 0 0 :::80 :::* LISTEN 12841/ixko.pl
[root@server /]# kill -9 12841
[root@server /]# netstat -lnp | grep :80
tcp 0 0 :::80 :::* LISTEN 12842/ixko.pl
[root@server /]# kill -9 12842
[root@server /]# netstat -lnp | grep :80
[root@server /]# netstat -lnp | grep :80 <-- and then httpd start automatic
tcp 0 0 :::80 :::* LISTEN 5861/httpd
[root@server /]#

[aquila]

Looks like some exploits on DA servers. I had this one lately on a server that we were going to migrate from. Since we had to cancel that server I did not have enough time to inspect.

When I say exploits on DA servers, I really don't mean DA has some vulnerability

[DutchTSE]

Looks like some exploits on DA servers. I had this one lately on a server that we were going to migrate from. Since we had to cancel that server I did not have enough time to inspect.

When I say exploits on DA servers, I really don't mean DA has some vulnerability

Check your FTP log.. i guess the perl scripts were uploaded and deleted in 1 second (= uploaded, started and removed by bots )

[Highway]

Check your FTP log.. i guess the perl scripts were uploaded and deleted in 1 second (= uploaded, started and removed by bots )

Yes, that is true. On one strange reason dit some users had CGI access.

Today was apache down again.

netstat -na | grep -i list | grep 80
tcp 0 0 :::80 :::* LISTEN
unix 2 [ ACC ] STREAM LISTENING 5180 /var/run/dovecot/dict-server

Nothing to see :S

[arazit]

for i in $(fuser 80/tcp);do kill -n 9 $i;done
service httpd restart

[xcoaster1]

I am seeing the same issue:

[root@srv01 run]# service httpd restart
Stopping httpd: [FAILED]
Starting httpd: [Fri Apr 15 15:54:27 2011] [warn] module jk_module is already loaded, skipping
[Fri Apr 15 15:54:27 2011] [warn] module ssl_module is already loaded, skipping
(98)Address already in use: make_sock: could not bind to address [::]:80
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
[FAILED]
[root@srv01 run]#

[root@srv01 run]# netstat -lnp | grep :80
tcp 0 0 :::80 :::* LISTEN 4658/httpd
[root@srv01 run]#

Any ideas!?

[SeLLeRoNe]

you have to find those file .pl and stop cgi on that domain, one of your user has been hacked.. prolly some permission wrong.

Regards

[xcoaster1]

sadly .. i do not have control over the box, helping a friend with their server and this is after a plesk upgrade to 10.2 .. so that might be part of the issue

[xcoaster1]

turns out it was ioncube loader ..

[nobaloney]

sadly .. i do not have control over the box, helping a friend with their server and this is after a plesk upgrade to 10.2 .. so that might be part of the issue

You're on a DirectAdmin forum. Questions for Plesk should be addressed to a Plesk forum. the two control panels are quite different from each other and may need totally different solutions.

Jeff

[autotron]

I am trying to install memcached now at the part where i need restart apache2 and get this

server:/# /etc/init.d/apache2 restart
Restarting web server: apache2(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
failed!
server:/# netstat -lnp | grep :80
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1336/httpd
server:/#

[autotron]

I am trying to install memcached now at the part where i need restart apache2 and get this

server:/# /etc/init.d/apache2 restart
Restarting web server: apache2(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
failed!
server:/# netstat -lnp | grep :80
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1336/httpd
server:/#

sorry for the double post....I killed the httpd processes and apache2 started fine but then httpd got the same error when i tried to start it, seems i can have one or the other not both running at one time

[NoBaloney2]

Of course you can't; httpd and apache2 are both names for the apache webserver.

You've probably got multiple apache servers on your system, both set to start up automatically.

Jeff