This morning apache stopped to serve pages. I have tried to restart it
with no success:
-------
init.d/httpd restart
----------
init.d/httpd stop
killall httpd
init.d/httpd start
------
killall httpd
init.d/httpd restart
---------
such like several times
every time failed with the
address already in use message
Was 4 oclock in the morning su I stopped investigating and restarted the machine
Is there a way to really shut down such a completely non-responsive process withou restarting the machine?
just a notice - there were not a heavy server load at the time
------------------
Server Version: Apache/2.2.6 (Mandriva Linux/PREFORK-8.2mdv2008.0) mod_ssl/2.2.6 OpenSSL/0.9.8e PHP/5.2.4 with Suhosin-Patch
Server Built: Sep 12 2008 14:54:18
I have a question related DDOS attack. My hosting provider told me that my Server was DDos attacked few days ago. But in those days my server worked fine only apache server was down. The strange fact is that in the same day with this "DDOS attack" one of theyr admins worked something on SSL section of my server and during this operation the SSL hosts were down and httpd worked slow.
Inthe passed 3 months httpd worked very slow and after 2-3 restarts of httpd service the load droped down below 3.00 . I believe theyr httpd service was already with problems and that SSL configuration cause that apache failure in that day with "ddos attack"
I repeat in that day ONLY ssl hosts worked fine and non SSL hosts were down.
It's possibile on DDOS attack that load to be unde 0.5 , SSL hosts to work fine, FTP, Mail and other stuf to work like there is nobody on server (VERY FAST)?
Code: ssh -fNg -L 8888:127.0.0.1:3306 user@123.456.789.0 How can sort of "undo" that? I ask because I need to re-tunnel in to a different IP address but right now the only way I can figure to do it is to restart my computer (which is lame).
One of my sites, hosts mp3s for music I've written for video games etc.
I uploaded a track in December, and this month my bandwith has rocketed from 18g to 25g.
When I look at the awstats I see this...
a.a.a.a11811181146.82 MB26 Jan 2007 - 17:47 a.a.a.a+11161116198.40 MB26 Jan 2007 - 17:49 b.b.b.b1151115119.61 KB26 Jan 2007 - 08:00 c.c.c.c62062023.71 MB26 Jan 2007 - 15:18 d.d.d.d543543025 Jan 2007 - 20:52 e.e.e.e537537025 Jan 2007 - 20:18 f.f.f.f 3103104.18 MB26 Jan 2007 - 17:00
Now I'm not sure about the MB values, they don't look true at all, but why suddenly would the two top places have the same IP address bar a value of 1
If I scroll down to file usage, I see
/blah/blah/blah.mp3 7533305.76 KB52685276 - so it's been viewed 7533 times
and the next most popular page or file is, / 10099.69 KB830412
Then looking at the search engine stats the most popular search engine phrase is this [url][summer dance]45041.2 %
450 times? and yes, - np2sp6qjpj2jkzevo5mcl2fjmw$$.mp3 [summer dance] - this is the filename coming up even though it doesn't exist on the server
It's twice as popular as "game sounds" which is the site, and is on google... something fishy going on here.
The most popular site to come from is [url] times in fact, and that's a japanese/chinese/eastern site which I don't understand.
The IP address appears to be chinese too.
Can anyone explain to me what might be going on here please? It appears that someone is continuously downloading this specific file, just to use up my bandwidth?
Just got alerted that my server is being used to send spam. Here is the information the datacenter gave me:
[information .....]
NOTE: I changed the real domain name and IP only.
Is there an expert who can help me decipher this? How do I find the culprit? My provider is threatening to shut me down and sink all my clients with the ship!
I am running the latest WHM and cpanel server, fyi.
Our website is based around a customer based chat system. Customers are only on the system during a particular day and time range. So for parts of the week the server gets almost no traffic. When then time for a chat comes up we get hundreds of people on the site all doing page requests every few seconds.
So as you might imagine we are bringing the server to it's knees with heavy CPU and memory loads. Plus bandwidth usage is really high. We are currently on the biggest box that Rackspace has to offer. The site runs ok on it during these times. It's a little slow but not unbearable.
But we have not hit our max customer base. In fact if all goes well we will double our customer base next month. So I know when we do we will bring that box down totally.
I was thinking about possibly trying a cloud/cluster based approach but after some research on this site I have found that is probably not the best option.
So I am looking for advice on what to do? Is there a better host? Different technology?
Servers are not my thing really so I could really use some help.
No we can't change the way customers access the site or when they access. There is nothing that can be done in that regard so don't suggest it.
I have seen posts that some hosts suspend a user after they so many seconds of high server resource usage... I was wondering how this is done so that I can do this on my dedicated server.
user1 is running some things on the server. I need user2 to be able to kill these processes (just kill, not start up again on the other user or any other extra priveledges). How can I do this?
Any tools, programs that will execute either with windows on (remote desktop) or install a boot script that will wipe off the hard-drive without going to the datacenter?
On our production service, we've been getting numerous malformed POST requests to some of our CGI scripts that are showing up as 500 errors in our logs. They are malformed in the sense that the actual content length doesn't match the Content-Length specified in the request.
Here's the most trivial example I can come up with that reproduces the problem for us:
In addition to the 500 error in the access log, we see the corresponding error in the error log:
(70014)End of file found: Error reading request entity data
Based on the nature of the POST request and the error response, it does appear that Apache is doing the right thing here.
The POST never actually makes it as far as the script being targeted (/some_valid_alias in the above example); in other words, Apache returns 500 to the client, writes the error to the error log and never executes the script.
Is there a way to capture/avoid internal Apache errors like 70014, and return some other HTTP status besides 500 (like 403)? It's particularly annoying in our case, because our server sends us an email for all 500 errors.
So far, our best "defense" against these 500 errors is to disallow POST for these aliases, which normally just ignore the POST data anyway (when the request is not malformed):
I've had this problem a long time now with my hosting network and decided to ask here hoping I get some good solutions, or if someone is willing to looking at this (I'll pay if they want).
Here's what I mean: [url]
Problem is as you can see apache processes constantly rise infinitely, at least until I restart apache (/etc/init.d/httpd restart). The point of restart is shown in red lines.
And after restart, it goes down again for X amount of hours then eventually rises again infinitely until it's restarted again.
But the fact that after restart it remains down, it means it had the potential to be down all along.
So my question is: what could be causing this and does anyone have solution to keep them low at all times (as per graphs)?
The Linux Server got down when the MaxClients 256 is reached. Error Log:
"server reached MaxClients setting, consider raising the MaxClients setting"
So that I have tried to increased the MaxClients Value to 500, after changed the value in httpd.conf and restart I get following error message.
" [notice] SIGHUP received. Attempting to restart WARNING: MaxClients of 500 exceeds ServerLimit value of 256 servers, lowering MaxClients to 256. To increase, please see the ServerLimit directive."
So that I tried changed the Server limit in /usr/local/apache/include/httpd.h header file. but it seems like there is no entry.
Apache Version : 2.2.8
So I have added the ServerLimit 500 entry in httpd.conf file and restart the httpd service. But still shows the same warning mesg. Please help me regarding this.
We have the Dedicated server for Flash Game Server with following configuration.
RHEL4 OS 2GB RAM Intel(R) Xeon(R) X3210 @ 2.13GHz Cpanel Installed. Apache 2.2.8 PHP 5.2.4 MySQL 4.1.2 (MySQL Server is working in differend server)
This redirect works fine on Apache 2.2.8, but doesn't work on Apache 1.3.41
The following is the entry from error_log: RewriteRule: cannot compile regular expression '^sap-latest-news/([0-9]*)/([A-Za-z0-9_-.]*).htm$'
A simple Rewrite is working fine in Apache 1.3, but the above regualar expression doesn't seem to be working on Apache 1.3. Does anyone know whether Apache 1.3 doesn't support it?
I am having an issue where I have a server that Directadmin is installed on. I go to the a url that is on the server and all i see is the default page of apache saying congrats, it is installed. Although there is no file like that in the public_html any longer and I can see my files in the public_html folder of that specific site.
I'm building a new server for a predominantly php5/mysql5 website and was wondering which version of apache to put on. I know there are some issues with PHP and Apache in MPM, but what's the performance comparison between Apache 1.3 and Apache 2 Prefork?
I am trying to install dedicated web server on my Slackware 12.0.0 machine. I am a novice in Linux, but succeeded in MySQL & proFTPd installation. The problem now in httpd compiling.
I downloaded the latest Apache 2.2.9, but it needs Apache Portable Runtime 1.3.2 installed. I downloaded 1.3.2 version and run ./configure
1. checking size of size_t... 4 2. checking which format to use for apr_size_t... %u 3. checking size of off_t... 4 4. checking for mmap64... yes 5. checking for sendfile64... yes 6. checking for sendfilev64... no 7. checking for mkstemp64... yes 8. checking for readdir64_r... yes 9. checking which type to use for apr_off_t... off64_t 10. checking whether ino_t and unsigned long are the same... yes 11. configure: using unsigned long for ino_t 12. checking size of pid_t... 4 13. checking whether byte ordering is bigendian... no 14. checking size of struct iovec... 8 15. checking for strnicmp... no 16. checking for strncasecmp... yes 17. checking for stricmp... no 18. checking for strcasecmp... yes 19. checking for strdup... yes 20. checking for strstr... yes 21. checking for memchr... yes 22. checking for strtoll... yes 23. 24. Checking for DSO... 25. checking for dlopen... no 26. checking for dlopen in -ldl... yes 27. adding "-ldl" to LIBS 28. checking for dlsym... yes 29. 30. Checking for Processes... 31. checking for waitpid... yes 32. checking for Variable Length Arrays... yes 33. checking struct rlimit... yes 34. 35. Checking for Locking... 36. checking for semget... yes 37. checking for semctl... yes 38. checking for flock... yes 39. checking for semaphore.h... (cached) yes 40. checking OS.h usability... no 41. checking OS.h presence... no 42. checking for OS.h... no 43. checking for library containing sem_open... none required 44. checking for sem_close... yes 45. checking for sem_unlink... yes 46. checking for sem_post... yes 47. checking for sem_wait... yes 48. checking for create_sem... no 49. checking for working sem_open... yes 50. checking for union semun in sys/sem.h... no 51. checking for LOCK_EX in sys/file.h... yes 52. checking for F_SETLK in fcntl.h... yes 53. checking for SEM_UNDO in sys/sem.h... yes 54. checking for POLLIN in poll.h sys/poll.h... yes 55. checking for PTHREAD_PROCESS_SHARED in pthread.h... yes 56. checking for pthread_mutexattr_setpshared... yes 57. checking for working PROCESS_SHARED locks... yes 58. checking for robust cross-process mutex support... yes 59. decision on apr_lock implementation method... SysV IPC semget() 60. checking if all interprocess locks affect threads... no 61. checking if POSIX sems affect threads in the same process... no 62. checking if SysV sems affect threads in the same process... no 63. checking if fcntl locks affect threads in the same process... no 64. checking if flock locks affect threads in the same process... no 65. checking for entropy source... /dev/urandom 66. 67. Checking for File Info Support... 68. checking for struct stat.st_blocks... yes 69. checking for struct stat.st_atimensec... no 70. checking for struct stat.st_ctimensec... no 71. checking for struct stat.st_mtimensec... no 72. checking for struct stat.st_atim.tv_nsec... yes 73. checking for struct stat.st_ctim.tv_nsec... yes 74. checking for struct stat.st_mtim.tv_nsec... yes 75. checking for struct stat.st_atime_n... no 76. checking for struct stat.st_ctime_n... no 77. checking for struct stat.st_mtime_n... no 78. checking for inode member of struct dirent... d_fileno 79. checking for file type member of struct dirent... d_type 80. 81. Checking for OS UUID Support... 82. checking uuid.h usability... no 83. checking uuid.h presence... no 84. checking for uuid.h... no 85. checking uuid/uuid.h usability... yes 86. checking uuid/uuid.h presence... yes 87. checking for uuid/uuid.h... yes 88. checking for library containing uuid_create... no 89. checking for library containing uuid_generate... -luuid 90. checking for uuid_create... no 91. checking for uuid_generate... yes 92. checking for os uuid usability... yes 93. 94. Checking for Time Support... 95. checking for struct tm.tm_gmtoff... yes 96. checking for struct tm.__tm_gmtoff... no 97. 98. Checking for Networking support... 99. checking for type in_addr... yes 100. checking if fd == socket on this platform... yes 101. checking style of gethostbyname_r routine... glibc2 102. checking 3rd argument to the gethostbyname_r routines... char 103. checking style of getservbyname_r routine... glibc2 104. checking if TCP_NODELAY setting is inherited from listening sockets... yes 105. checking if O_NONBLOCK setting is inherited from listening sockets... no 106. checking whether TCP_NODELAY and TCP_CORK can both be enabled... yes 107. checking for TCP_CORK in netinet/tcp.h... yes 108. checking for TCP_NOPUSH in netinet/tcp.h... no 109. checking for SO_ACCEPTFILTER in sys/socket.h... no 110. checking whether SCTP is supported... no 111. checking for struct ip_mreq... yes 112. checking for set_h_errno... no 113. 114. Checking for IPv6 Networking support... 115. checking for library containing getaddrinfo... none required 116. checking for library containing gai_strerror... none required 117. checking for library containing getnameinfo... none required 118. checking for gai_strerror... yes 119. checking for working getaddrinfo... yes 120. checking for negative error codes for getaddrinfo... yes 121. checking for working getnameinfo... yes 122. checking for sockaddr_in6... yes 123. checking for sockaddr_storage... yes 124. checking for working AI_ADDRCONFIG... yes 125. checking if APR supports IPv6... yes 126. checking langinfo.h usability... yes 127. checking langinfo.h presence... yes 128. checking for langinfo.h... yes 129. checking for nl_langinfo... yes 130. 131. Restore user-defined environment settings... 132. restoring CPPFLAGS to "" 133. setting EXTRA_CPPFLAGS to "-DLINUX=2 -D_REENTRANT -D_GNU_SOURCE -D_LARGEFILE64_SOURCE" 134. restoring CFLAGS to "" 135. setting EXTRA_CFLAGS to "-g -O2 -pthread" 136. restoring LDFLAGS to "" 137. setting EXTRA_LDFLAGS to "" 138. restoring LIBS to "" 139. setting EXTRA_LIBS to "-luuid -lrt -lcrypt -lpthread -ldl" 140. restoring INCLUDES to "" 141. setting EXTRA_INCLUDES to "" 142. configure: creating ./config.status 143. config.status: creating Makefile 144. config.status: creating include/apr.h 145. config.status: creating build/apr_rules.mk 146. config.status: creating build/pkg/pkginfo 147. config.status: creating apr--config 148. config.status: WARNING: 'apr-config.in' seems to ignore the --datarootdir setting 149. config.status: creating apr.pc 150. config.status: creating test/Makefile 151. config.status: creating test/internal/Makefile 152. config.status: creating include/arch/unix/apr_private.h 153. config.status: executing default commands 154. config.status: include/apr.h is unchanged 155. config.status: include/arch/unix/apr_private.h is unchanged
After that I am trying make and have error at the end:
In the middle of recompiling apache (via whm) after upgrading postgresql to 8.3, apache went down and remains down even after restart. Recompile is still in progress (about 15 minutes in)
tail -f /usr/local/apache/logs/error_log [Wed Nov 12 15:24:44 2008] [warn] No JkShmFile defined in httpd.conf. Using default /usr/local/apache/logs/jk-runtime-status [Wed Nov 12 15:24:44 2008] [notice] ModSecurity for Apache/2.5.7 (http://www.modsecurity.org/) configured. [Wed Nov 12 15:24:46 2008] [warn] No JkShmFile defined in httpd.conf. Using default /usr/local/apache/logs/jk-runtime-status [Wed Nov 12 15:24:46 2008] [alert] getpwuid: couldn't determine user name from uid 4294967295, you probably need to modify the User directive [Wed Nov 12 15:24:46 2008] [alert] getpwuid: couldn't determine user name from uid 4294967295, you probably need to modify the User directive [Wed Nov 12 15:24:46 2008] [alert] getpwuid: couldn't determine user name from uid 4294967295, you probably need to modify the User directive [Wed Nov 12 15:24:46 2008] [alert] getpwuid: couldn't determine user name from uid 4294967295, you probably need to modify the User directive [Wed Nov 12 15:24:46 2008] [alert] getpwuid: couldn't determine user name from uid 4294967295, you probably need to modify the User directive [Wed Nov 12 15:24:46 2008] [notice] Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_jk/1.2.25 PHP/5.2.6 configured -- resuming normal operations [Wed Nov 12 15:24:46 2008] [alert] Child 22588 returned a Fatal error... Apache is exiting! httpd configtest Syntax OK ps -ef | grep ^httpd (no result) Cpanel/Centos
