Apache processes problems

[pzelf]

Im having the same problem on 2 of my servers, both with directadmin.
One server is running CentOS with previos version of apaceh, the other one RedHat with apache 2

What happens is that my sites are unavailable on average 3 times dayly.

The only thing that makes them available/reachable again is to restart the httpd process via directadmin.

Then the sites run fine for a little while, but within a few hours the same thing happens again.

I suspect that the problem is that directadmin doesnt close the httpd processes correctly.

when i look at the running processes via directadmin ( when my sites are unreachable) , i see this:

httpd (pid 3157 3175 3176 3178 3179 3182 3183 3218 3225 3226 3228 3229 3230 3231 3243 3244 3245 3246 3247 3248 3249 3250 3253 3254 3255 3256 3257 3258 3259 3260 3261 3262 3263 3264 3265 3266 3267 3268 3270 3271 3272 3273 3274 3275 3277 3278 3279 3291 3292 4161 4162 4163 4164 4165 4166 4167 4168 4169 4170 4171 4172 4174 4175 4178 4179 4180 4182 4183 4190 4243 4244 4245 4249 4250 4251 4252 4254 4255 4258 4323 4325 4326 4329 4330 4331 4479 4480 4577 4580 4581 4582 4583 4584 4585 4587 4588 4589 4590 4591 4595 4597 4601 4602 4749 4752 4755 4766 4833 5266 5669 5677 5707 6019 6094 6245 6467 6533 6535 6585 6712 6714 6733 6752 6983 6985 6991 7039 7042 7043 7052 7058 7062 7152 7301 7304 7307 7310 7356 7378 7382 7411 7494 7499 7573 7578 7584 7594 7595 7600 7606 7620 7699 7748 7774 7811 7812 7813 7814 7815 7816 7827 7830 7837 7841 7842 7846 7850 7855 7943 8004 8006 8016 8020 8025 8026 8029 8036 8148 8150 8151 8156 8160 8161 8162 8163 8164 8165 8166 8175 8180 8181 8184 8186 8188 8223 8227 8231 8232 8233 8234 8236 8238 8242 8243 8247 8254 8268 8349 8355 8357 8526 8536 8541 8544 8570 8582 8590 8601 8630 8827 8830 8841 8850 8856 8883 8915 9066 9075 9092 9133 9606 9807 9849 9860 9913 9935 9952 9953 9958 9959 9960 9961 9972 9973 9974 9975 9976 9985 9986 9987 9988 9990 9991 9993 9996 9997 10002 10003 10004 10005 10007 10008 10009 10010 10011 10012 10014 10016 10017 10018 10019 10021 10213 10237 10404 10431 10432 10434 10452 10453 10454 10457 10458 10465 10466 10467 10468 10471 10472 10475 10476 10477 10478 10480 10481 10484 10485 10487 10489 10490 10491 10492 10493 10495 10496 10497 10499 10502 10503 10505 10506 10507 10508 10517 10518 10520 10522 10524 10525 10528 10529 10531 10532 10533 10534 10539 10542 10545 10546 10548 10550 10551 10552 10555 10558 10561 10563 10564 10565 10568 10569 10577 10578 10581 10582 10587 10592 10596 10597 10598 10600 10660 11966 11982 11986 11989 11990 12001 12003 12004 12008 12012 12013 12015 12016 12017 12018 12019 12020 12021 12022 12024 12025 12026 12027 12028 12029 12031 12032 12033 12035 12037

MANY running processes!

Now, when i look via shell "top" command AT THE SAME TIME, i see
this:

login as: root
root@server 's password:
Last login: Sat May 26 18:00:43 2007 from server.
[root@server ~]# top
top - 12:29:18 up 6 days, 1:58, 1 user, load average: 0.12, 0.08, 0.20
Tasks: 242 total, 1 running, 241 sleeping, 0 stopped, 0 zombie
Cpu(s): 12.0% us, 0.0% sy, 0.0% ni, 88.0% id, 0.0% wa, 0.0% hi, 0.0% si
Mem: 2066752k total, 1968476k used, 98276k free, 104464k buffers
Swap: 2096472k total, 239856k used, 1856616k free, 1232856k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
21352 apache 16 0 26080 14m 4068 S 11.3 0.7 0:01.36 httpd
8280 apache 16 0 27304 15m 3928 S 0.3 0.8 0:06.12 httpd

Notice, very little load average, 241 sleeping processes, and only 1 running
process.

Resume: Directadmin sees MANY running processes, via shell i see only 1 running process!
the same thing happens on both servers. Does anyone know how i could solve this?

 

[capadokya]

DA is the best

Hi, The high PID from apache has nothing to do with DA.
You are getting dos attackes or SYN flood
You have to install a good firewall witch automaticly bloks these.

regards

 

[nobaloney]

pzelf,

Try restarting apache from the command line, and see what kind of warnings/errors you get.

Jeff

 

[pzelf]

firewall is installed and working, also installed mod_evasive but im still gettin the same problems.

I notice a LOT of the same errors in apache error log:
[Tue Jun 19 08:29:01 2007] [error] child process 6734 still did not exit, sending a SIGKILL
[Tue Jun 19 08:29:01 2007] [error] child process 6735 still did not exit, sending a SIGKILL
[Tue Jun 19 08:29:01 2007] [error] child process 6792 still did not exit, sending a SIGKILL
[Tue Jun 19 08:29:01 2007] [error] child process 6551 still did not exit, sending a SIGKILL
[Tue Jun 19 08:29:01 2007] [error] child process 6554 still did not exit, sending a SIGKILL
[Tue Jun 19 08:29:01 2007] [error] child process 6740 still did not exit, sending a SIGKILL
[Tue Jun 19 08:29:01 2007] [error] child process 6793 still did not exit, sending a SIGKILL
[Tue Jun 19 08:29:01 2007] [error] child process 6562 still did not exit, sending a SIGKILL
[Tue Jun 19 08:29:01 2007] [error] child process 6706 still did not exit, sending a SIGKILL
[Tue Jun 19 08:29:01 2007] [error] child process 6565 still did not exit, sending a SIGKILL
[Tue Jun 19 08:29:01 2007] [error] child process 6566 still did not exit, sending a SIGKILL

any ideas?

 

[smtalk]

Lower your TimeOut to ~5, set KeepAliveTimeout 0, increase Min/MaxSpareServers and restart apache. Then try DDOS Deflate - http://blog.medialayer.com/projects-ddos-deflate/ and harden your sysctl.conf a bit.