server crashes after strange errors from http request

[pppplus]

My server crashes (270 of load average) and do not answer any more.
I have to restart httpd

[Tue May 24 12:43:01 2011] [error] [client 41.35.78.94] Invalid URI in request ccept: */*
[Tue May 24 12:43:01 2011] [error] [client 41.35.78.94] File does not exist: /var/www/html/400.shtml
[Tue May 24 12:43:08 2011] [error] [client 196.221.226.182] Invalid URI in request ation/xhtml+xml, */*
[Tue May 24 12:43:08 2011] [error] [client 196.221.226.182] File does not exist: /var/www/html/400.shtml
[Tue May 24 12:43:33 2011] [error] [client 113.190.214.214] Invalid URI in request ccept: */*
[Tue May 24 12:43:33 2011] [error] [client 113.190.214.214] File does not exist: /var/www/html/400.shtml
[Tue May 24 12:45:24 2011] [error] [client 119.139.99.1] Invalid URI in request Cookie: : 300, referer: http://regiecpm.fr.cr/ban.php?id=85&f=468x60
[Tue May 24 12:45:24 2011] [error] [client 119.139.99.1] File does not exist: /var/www/html/400.shtml, referer: http://regiecpm.fr.cr/ban.php?id=85&f=468x60
file: unrecognized option `--mime-type'
Usage: file [-bcikLhnNsvz] [-f namefile] [-F separator] [-m magicfiles] file...
       file -C -m magicfiles

Some invalid URI request, then file: unrecognized option `--mime-type'

And it appears this happens just before server stopped to answer.

Do you have an idea of what can do this ?

I suppose, it's an advertise on a small advertise company which send something bad. But how can these bad requests affect the server ?

Thanks for your help and ideas.

 

[LawsHosting]

Block the IP then see if it still crashes.

Note: If its just a handful of IPs that is.

 

[pppplus]

Thanks, but it is not always this IP. It changes regularly.

It is just an idea, a bad advertisement try something wrong when it is called by a visitor (but I have the IP of this visitor, who has nothing to do with the problem).

These messages comes from differents small advertisements company, using probably the same bad tag.

And I am not sure this is the source of problem.

 

[LawsHosting]

When this happens, is the referrer always from Regiecpm.fr.cr?

 

[pppplus]

No, there are at least 4 differents websites (but they are all small advertisment websites, so they can diffuse tag from the same source)

 

[zEitEr]

If you use mod_security you might want to deny such requests.

Can you post an example of a link, that crashes your server privately? Did you try such a link yourself?

Will this help you http://www.prestashop.com/forums/vi..._internal_server_error_when_using_backoffice/ ?

 

[pppplus]

Hi, thanks for you suggestions.

1- yes I try to visit the referer, but pages always change, it is dynamic advertisment, so not always such page shown

2- I know the page in prestashop, because I use prestashop and know this bug. And I find it when I search for my problem in google.

3- mod_security is activate

4- I think now the problem comes from another way !

This morning, I see RAM memory almost full used (by htop). Normally, server used about 6-7 Go and I have 12Go.
And load average begin to increase. (but no problem for the moment)

The message with error and strange request are always present, (but it was the same all the night, without crash)

One client asks me to go in his website, because it doesn't work fine. It's a blog with WP.
The page is very very low. And after some refresh, server load average increase a lot, going to 200 !

I restart httpd and it's ok.

A lot of process in phpmyadmin for this blog are present, with status "sleep". I go in admin, and delete one RSS request in HeatMap Adsense Theme 2.5.4. This RSS shown invalide feed in the page.

After that, no problem at all in the blog, and no more problem in the server.

So maybe, I suppose this blog can be the problem. But not sure, it can be a coincidence, and crash arrives exactly when I open this blog...

Now one other question, if this blog was the problem :
- how can I avoid, that a just a website crash the server ?
The website use only few bandwith (2.5 Go this month - that a lot for a very small blog, but very small for the server)

 

[zEitEr]

I don't know what is done already from the following, nevertheless you can try to:

1. Disable persistent connection from PHP scripts to MySQL server. Edit php.ini.
2. Lower number of max allowed connections from one user to MySQL server. Edit php.ini and /etc/my.cnf
3. Lower number of max servers/users in Apache config.
4. If you run mod_php, you might want to install eAccelerator
5. You might want to install a frontend to your apache (nginx, squid, oops, lightttpd, etc). It will help to lower load on apache.
6. Tune mysql settings. Script https://github.com/rackerhacker/MySQLTuner-perl/blob/master/mysqltuner.pl might help you.
7. Enable a cache module in WP, if not enabled yet.