Apache Hangs When Having Lots Of ..reading.. Requests
Jan 26, 2008
A weird thing happents once on few days on my server, and it's not a regular thing or on exact time.
When I have this problem no page can be loaded in the browser, but WHM is working, i think because it's accessed by IP .
In apache status page I can see lots of ..reading.. requests which are there even for 10 - 20 seconds sometimes.
Usualy the server has 10 - 20 requests/s :
CPU Usage: u35146 s2297.05 cu2.74 cs4.5 - 6.97% CPU load
11.2 requests/sec - 83.0 kB/second - 7.4 kB/request
10 requests currently being processed, 8 idle servers
But when the ..reading.. requests appear it goes much higher like 100 to 200
11.5 requests/sec - 85.3 kB/second - 7.5 kB/request
200 requests currently being processed, 0 idle servers
after 3 minutes :
160 requests currently being processed, 30 idle servers
When I logged on to SSH I saw that there are ~150 conection from a single IP .
View 14 Replies
ADVERTISEMENT
Mar 31, 2008
I have been experiencing a lot of Keepalive requests for a particular image on a particular domain. please see the lines below.
0-11233931/63/63K 0.15100.40.030.03 195.68.185.13mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
1-11233941/77/77K 0.18100.40.050.05 122.164.58.63mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
2-11233951/42/42K 0.76000.40.170.17 89.139.214.74mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
3-11233971/57/57K 0.04000.40.020.02 82.199.98.229mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
4-11233981/46/46K 0.27000.40.040.04 217.150.55.41mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
These are just a few lines from the top.
How can i prevent this from happening.. it seems as a SYN Flood, or maybe a DDoS.
View 3 Replies
View Related
Oct 7, 2009
I have a dedicated server which I am managing myself. I have experienced a strange thing today. The whole Apache daemon seemed to be hung. Every Web request resulted in a timeout, even when executed from localhost. The CPU usage has been minimal (like 99.7% idle). No MySQL long statements being executed, nothing. mod_status did not help me, because requesting the status also hung (as it is retrieved by HTTP). After Apache restart everything went back to normal.
I have no idea what could have happened, and moreover Apache does not provide me with any tools to diagnose it (because mod_status doesnot work in such situation). So I am asking you for help - do you have any idea what I could do when such problem repeats to diagnose its source?
View 3 Replies
View Related
Mar 29, 2008
I run a large service on 2 machines (we're talking 8x2.66Ghz processing power, 4-6GB ram, etc), however we are thinking about creating a node/clustered setup to help spread the load, bandwidth, mysql (having one server for hundreds of thousands of databases is not wise it seems :p), diskspace etc. Lots of machines just seems to be a cheaper and more powerful option.
Would you advise going with lots of lower end machines, or just a few mid-range machines.
Here is what I propose:
3 of these
Dual Xeon 3GHZ Dual-Core (4x3GHz)
3GB RAM
500GB Sata Drive
4000 GB Bandwidth
100mbit
or
4 of these
XEON X3220 QUAD CORE 2.4GHZ 1066FSB
2GB DDR2 RAM (Upgradeable)
250GB HDD
2000GB Bandwidth
100mbit
or
7 of these
Dual Xeon 3.06 Ghz
2GB DDR2 RAM
250GB SATA
2000GB BW/MONTH
100mbit
All of the above are roughly similar prices in total.
View 5 Replies
View Related
May 28, 2008
We have flash files site hosted on dedicated server in that Apache is utilizing the more CPU. When the server reached more than 1000 connections server get down automatically.
Hard Server Limit : 2048
MaxClients : 2000
Please find below the TOP status.
8450 nobody 16 0 19 0:20.52 1.2 39404 23m 3008 R httpd
3242 nobody 15 0 16 1:07.17 1.2 39696 24m 3032 S httpd
9492 nobody 16 0 12 0:00.39 0.7 29616 14m 3000 R httpd
3372 nobody 15 0 12 1:23.31 0.5 24864 9992 3036 S httpd
9477 nobody 15 0 11 0:00.88 0.5 24692 9784 3000 S httpd
9021 nobody 15 0 10 0:01.69 1.2 39660 24m 2996 S httpd
3240 nobody 15 0 10 1:39.71 1.2 39664 24m 3420 R httpd
4141 nobody 16 0 10 1:30.65 1.2 39792 24m 3032 R httpd
5458 nobody 15 0 10 1:04.21 0.5 24720 9824 3012 S httpd
9466 nobody 15 0 10 0:00.96 0.5 24672 9764 3000 S httpd
9478 nobody 15 0 10 0:00.98 0.5 24676 9764 2996 S httpd
3354 nobody 16 0 10 1:23.78 0.5 25132 9m 3044 R httpd
3361 nobody 15 0 10 1:21.61 0.5 24864 10m 3576 S httpd
5451 nobody 16 0 10 1:09.14 1.2 39664 23m 3036 R httpd
5457 nobody 15 0 10 1:12.76 1.2 39664 24m 3556 S httpd
9444 nobody 16 0 10 0:01.72 1.2 39656 24m 2996 R httpd
9481 nobody 15 0 10 0:00.65 1.2 39652 24m 3000 R httpd
3338 nobody 16 0 9 1:32.72 1.2 39256 23m 3036 R httpd
3360 nobody 15 0 9 1:44.38 1.2 39772 24m 3440 R httpd
4142 nobody 15 0 9 1:40.64 1.2 39760 24m 3440 S httpd
9493 nobody 15 0 9 0:01.25 0.5 24704 9796 3024 S httpd
9504 nobody 15 0 9 0:00.29 0.5 24688 9744 2984 S httpd
3305 nobody 16 0 9 1:08.11 1.2 39404 23m 3012 R httpd
3359 nobody 15 0 9 0:47.17 0.5 24812 9936 3032 S httpd
3363 nobody 16 0 9 1:44.42 1.2 39432 23m 3044 R httpd
5450 nobody 15 0 9 1:18.81 0.5 24900 9996 3032 S httpd
9486 nobody 16 0 9 0:00.59 1.2 39664 23m 2996 R httpd
3358 nobody 16 0 9 1:46.50 1.2 39520 24m 3452 R httpd
9096 nobody 16 0 9 0:07.87 1.1 38612 23m 3004 R httpd
3370 nobody 16 0 8 1:32.55 1.2 39200 23m 3012 R httpd
8515 nobody 16 0 8 0:12.52 1.2 39404 23m 3024 R httpd
9445 nobody 16 0 8 0:02.70 1.2 39404 23m 3000 R httpd
Apache Compailed with following modules.
./configure' '--disable-pdo' '--enable-ftp' '--enable-gd-native-ttf' '--enable-libxml' '--enable-magic-quotes' '--enable-mbstring' '--enable-sockets' '--prefix=/usr/local' '--with-apxs=/usr/local/apache/bin/apxs' '--with-curl=/opt/curl/' '--with-freetype-dir=/usr' '--with-gd' '--with-jpeg-dir=/usr' '--with-libxml-dir=/opt/xml2/' '--with-mhash=/opt/mhash/' '--with-mysql' '--with-png-dir=/usr' '--with-ttf' '--with-xpm-dir=/usr/X11R6' '--with-zlib' '--with-zlib-dir=/usr'
Apache : 2.2.8
PHP : 5.2.4
MySQL : 4.1.1
RAM : 2 GB
CPU : Intel(R) Xeon(R)
Cpanel Installed
View 3 Replies
View Related
Feb 5, 2007
As you can see my apache is full of Reading connections..... they are filling up my server dening legitimate users to browse trought the websites hosted there... I think this is what is happening to me:
http://mail-archives.apache.org/mod_...l.gmail.com%3E
Im using apache 1.3.3.7 on RHES 3 with latest patches and kernel.
930 requests currently being processed, 6 idle servers
RRRRRRRRWRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRR
RRRRRRRRRWRRRWRRRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR_RRRRRRRRRRRRR_RRRRRRR
RRRRRRRRRRRRRRRRRRRRRRWRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
R_WRRRRRRRRRRRRRRRRRRRRWWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRRRR
RRRRRRRRRRRRRWRR_RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR_
RRRRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRR_RRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRR
RRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRR.RRR.......................
1-044940/40/40R 0.33340.00.060.06 ??..reading..
2-044950/55/55R 0.47330.00.110.11 ??..reading..
3-044960/35/35R 0.31330.00.050.05 ??..reading..
4-044970/38/38R 0.13210.00.090.09 ??..reading..
5-045410/40/40R 0.16360.00.130.13 ??..reading..
6-046190/28/28R 0.12110.00.030.03 ??..reading..
7-046220/34/34R 0.35320.00.100.10 ??..reading..
8-051640/34/34R 0.135100.00.300.30 ??..reading..
Also, here is the top output of the top command:
top - 12:46:21 up 10 min, 1 user, load average: 1.40, 2.03, 1.06
Tasks: 1063 total, 2 running, 1060 sleeping, 0 stopped, 1 zombie
Cpu(s): 4.9% us, 1.6% sy, 0.0% ni, 93.1% id, 0.3% wa, 0.0% hi, 0.0% si
Mem: 2073516k total, 2001984k used, 71532k free, 42384k buffers
Swap: 2048276k total, 0k used, 2048276k free, 178096k cached
Server seems to be fine, but total tasks are always between 1060 and 1124... thats very rare too..
how to avoid this attack?
View 14 Replies
View Related
May 1, 2014
I moved my sites to new linux server of mine (apache, mysql, php).
From that time i experienced some bigger websites hanging for like 2-3 seconds before they start loading. I mean when im browsing thru my website i click link, submit something and it waits saying in status field like "Waiting for mywebsite.com"
So i want to ask what apache, php etc values, what to check on server?
NOTE: my server is NOT overloaded (I am checking "top -c" stats) so don't suggest me to upgrade etc.
I have impression that it is waited until website elements are loaded and then webpage load very quickly after mentioned 2-3 seconds delay..
View 1 Replies
View Related
Jan 4, 2007
I am running apache 2.0 on CentOS 4.4 with PHP5 and mysql 5. I am wondering why the following is happening with apache:
if I goto to [url]
This does not work, it times out. But if I goto:
[url]
With the trailing slash it works. That is annoying, anyway to take care of that so it works with or without the trailing slash? Below is my httpd.conf folder and virtual host settings:
---------------------------------------------------------------------------------------------------------------
<VirtualHost *>
ServerAdmin myemail@mydomain.com
DirectoryIndex index.php index.html index.htm index.shtml
<Directory "/var/www/html/">
Options ExecCGI FollowSymLinks Includes IncludesNOEXEC SymLinksIfOwnerMatch
AllowOverride none
</Directory>
</VirtualHost>
#
# Each directory to which Apache has access can be configured with respect
# to which services and features are allowed and/or disabled in that
# directory (and its subdirectories).
#
# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.
#
<Directory "/">
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory "/var/www/html">
Options Indexes Includes FollowSymLinks
AllowOverride None
Allow from all
Order allow,deny
</Directory>
<Directory "/var/www/icons">
Options Indexes MultiViews
AllowOverride None
Allow from all
Order allow,deny
</Directory>
<Directory "/var/www/cgi-bin">
Options ExecCGI
AllowOverride None
Allow from all
Order allow,deny
</Directory>
View 13 Replies
View Related
Nov 24, 2013
I have installed APC on our Windows server. After I enable APC and restart apache our pages throwing Lots of PHP Notices.
Code :
System Windows NT 6.1 build 7601 (Windows Server 2008 R2 Web Server Edition Service Pack 1) i586Architecture x86Server API Apache 2.4 Handler Apache LoungeThread Safety enabledPHP Extension Build API20100525,TS,VC9Apache Version Apache/2.4.2 (Win32) OpenSSL/1.0.1c PHP/5.4.4Virtual Server Yes
View 2 Replies
View Related
Aug 6, 2014
We are currently using Apache 2.2.10 as the reverse proxy for the SAP portal server 7.3.1. The SAP applications are built based on webdynpro abap technology.2 of the apps are getting intermittent spinning circles. The Apache server will ultimately timeout and give the "bad request" and HTTP 400. We were never able to reproduce the problem except we do see users are running into them. Obviously, the problems occur very randomly, but often enough to generate a lot of support tickets. No error was generated in the sap system log.
Here is what I see from the apache access log and error log:
[31/Jul/2014:23:50:26 -0400] TLSv1 AES128-SHA "POST /sap/bc/webdynpro/sap/ZR_SSEPP_OPERATIONAL_SCHEDULE;sap-ext-sid=VcFRQjFOvu8TJYp9gDoeAA--4x1GQAg0MPPjCUEQif5iWQ--?sap-contextid=SID%3aANON%3asapprd_PR3_03%3aezUnW-FXtaYVyXREaAD7rxW0k8o5pk_n9RfjPfcB-NEW HTTP/1.1" 400 3004 "https://xxxxx/sap/bc/webdynpro/sap/ZR_SSEPP_OPERATIONAL_SCHEDULE;sap-ext-sid=VcFRQjFOvu8TJYp9gDoeAA--4x1GQAg0MPPjCUEQif5iWQ--" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" 706345611
[Fri Aug 01 14:19:07 2014] [error] [client 10.4.53.198] (70014)End of file found: proxy: error reading status line from remote server xxxxxx, referer: https://xxxxx/sap/bc/webdynpro/sap/ZR_SSEPP_OPERATIONAL_SCHEDULE;sap-ext-sid=RaH2yjQlV6o7wVaj6wv6zA--LXTMFzjjKvcuwT*DXWoBmA--
I found bug 37770 and went to see the apache admin. But he thinks that the parameter(proxy-initial-not-pooled=1) that fixes the bug only applies to mod_proxy_http. However, we are using mod_proxy.
View 1 Replies
View Related
Feb 8, 2007
I have a dedicated box with softlayer and I have noticed at varying times the past few months that with sites we host, sometimes the connection times out (I'll try to access like 5 or 6 sites within 30 seconds or so and they all drop, then a minute later they load fine).
I opened a support ticket and they said it usually has to do with the # of requests Apache can handle, and that this can be modified. They stated they could: "tweak the apache configuration file in this server that can make it possible to handle more requests."
So my question is what should the # of requests be set to? (I'm not sure what it is now, but I assume whatever the default # is).
View 6 Replies
View Related
Oct 17, 2013
We have been using Apache 2.2.x with reverse proxy modules for our clients to access their OWA servers for over a year. I want to get us to Apache 2.4.x so I setup a test box with latest 2.4 on it. I fixed the config file issues since 2.4 has changes in it. OWA proxy is working on my test server with Apache 2.4. But with 2.4 I do have an issue I cannot figure out. Note that this does NOT occur with Apache 2.2. I get the following errors when using ActiveSync through reverse proxy:
[Thu Oct 17 12:19:11.670665 2013] [proxy_http:error] [pid 748:tid 8440] (OS 10060)A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. : [client x.x.x.x:20311] AH01102: error reading status line from remote server mail.nameredacted.net:443
[Thu Oct 17 12:19:11.670665 2013] [proxy:error] [pid 748:tid 8440] [client x.x.x.x:20311] AH00898: Error reading from remote server returned by /Microsoft-Server-ActiveSync
So somehow with Apache 2.4 there is some sort of timeout that was not there with 2.2.
View 2 Replies
View Related
Sep 16, 2014
We have an Apache acting as a reverse-proxy and listening on the Internet ("Our URL" on port 443).
We would have two ways of accessing this reverse-proxy:
-From a mobile app (authentication would be based on a corporate certificate)
-From any browser (authentication would be a login form)
The question is: can Apache forward requests to either server 1 or server 2, depending on whether a certificate is sent by the client?
View 10 Replies
View Related
Sep 29, 2013
I have Apache 2.4.2, OpenSSL/1.0.1c, on Windows Web Server 2008 R2 (64 bits)
After 12 hours of heavier load, the SSL requests stopped working/being answered. However if you requested the same page via http instead of https, it worked fine. Restarting the Apache server fixes this, for a while. Again after a few hours of traffic, the https requests stopped working again. I checked the logs, and nothing notable, the mod_ssl entries just...
The site is called only by client developed with Delphi 2007 (CodeGear user-agent). Delphi client use THTTPRIO for sending HTTPS request to SOAP.
View 9 Replies
View Related
Dec 13, 2012
So I just upgraded Apache 2.2.22 to Apache 2.4.3 and made sure to go through all the options that had changed and update the conf file accordingly. This included adding the cache module for SSL and changing the SSLMutex option over to Mutex default ssl-cache. We also turned off SSLCompression due to the CRIME attack vulnerability.
We use apache strictly as a loadbalancer to 2 tomcat servers via mod_jk. Apache serves no static content at this time.
After being deployed, everything worked fine until later in the day. After 3 hours of heavier load (our site only takes significant traffic during business hours), the SSL requests stopped working/being answered. However if you requested the same page via http instead of https, it worked fine.
Restarting the Apache server fixes this, for a while. Again after a few hours of traffic, the https requests stopped working again. This time I turned the loglevel up to debug and restarted the Apache server.
As traffic slowed down it took another 6 or 7 hours before SSL requests stopped working again. I checked the logs, and nothing notable, the mod_ssl entries just... stopped. (I don't know for sure its ammount of traffic related, it just seems that way)
I have tried reproducing this in a lab, but have not been able to get it to happen on the lab server.
OS: Windows Server 2008 R2
Apache: 2.4.3 vc9 build with OpenSSL 0.9.8 downloaded from apachelounge.org
Mod_JK Version 1.2.37 vc9 also downloaded from apachelounge.
View 10 Replies
View Related
Apr 12, 2014
I've spent the last several months working on a huge upgrade of a couple dozen websites. The upgrades include modifying Apache so that visitors who arrive at links pointing to mysite/World/New_York are redirected to mysite/world/new-york. In other words, all my links now default to lower case, and underscores are replaced with dashes.
Unfortunately, publishing it has been an endless series of disasters. My websites are now all crashed, and the server is unbelievably slow. It takes pages forever to load (if they load at all), and I can scarcely publish files online.So the following notice sent to me by my webhost got my attention.
IT appears your own server IP is making GET requests to Apache, causing excessive loading and causing service failures. On today's date, your IP made almost 6,000 connections to Apache:<br><br>
[root@host ~]# grep 64.91.229.106 /usr/local/apache/domlogs/mysite.org | wc -l 5924 [root@host ~]#<br><br>
These were all the same request:<br><br>
64.91.229.106 - - [12/Apr/2014:08:10:10 -0400] "GET /404.php HTTP/1.0" 200 14294 "-" "-"<br><br>
And that made up the total of requests:<br><br>
[root@host ~]# grep 64.91.229.106 /usr/local/apache/domlogs/mysite.org | grep "GET /404.php HTTP/1.0" | wc -l 5924 [root@host ~]#<br><br>
View 1 Replies
View Related
May 25, 2015
I have a little problem (on my Raspberry) with the maximum concurrent connections.When I open multiple tabs of a webpage which keeps persistent connections, apache is unable to serve more requests.Here is the (shortened) mod_info output (which also takes some time till there is a process kind enough to serve the request):
Code:
Server Version: Apache/2.4.10 (Raspbian) OpenSSL/1.0.1k
Server MPM: prefork
5 requests currently being processed, 9 idle workers
.___W____WWW_..W_...............................................
................................................................
......................
Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request
[Code] ....
When I understood it correctly, apache should spawn new processes (up to MaxRequestWorkers=150)
But there are idle???? processes, so it wont add new ones?
I dont think it has to do with mod_proxy (used for the webpage) since the mod_info output is affected as well...
View 1 Replies
View Related
Feb 20, 2013
I have an Apache Server (2.4.3) and a Tomcat Server (7.0.36) and have some Java Applications deployed.Everything works fine, but when we start a quite long Ajax process, I see in my Java Application, that a Ajax request is received and starts processing - everything fine. But during processing of the first request, I see a second request starts after 5 minutes.
View 1 Replies
View Related
Jan 19, 2008
I currently have a web VPS hosted with FDCServers.net and after 5 days of switching to it i am getting massive HTTP requests. When i login to WHM and hit apache status i have many requests per second by multiple IP's that are going to pages that simple don't exist. Currently my hostname for the server is set at web-01.optical-hosting.com which is what the requests are being sent to. I am also having a DNS issue because when i put http://web-01.optical-hosting.com in the web browser it displays the first account's site under "list accounts" in cpanel. Can someone please help me fix both of these issue's? i will post an apache log in a second post as it is long. Also, these are from overseas. please someone help me with this i have Aim and Msn.
View 4 Replies
View Related
Apr 10, 2013
I'm looking to pass the entries to a web form, via Apache, to an external process (listening on a port say 4321) running on the same host as Apache.Is there a way to "coerce" Apache into doing this?
View 1 Replies
View Related
Jun 4, 2009
My Linux Server's Http Daemon (Apache) would stop serving websites ever so often, as soon as apache is restarted the error fixes iteself only to resurface within few hours.
The apache process would still be running i.e. apache does not die but no websites hosted on my server would be accessible from browser. And when this happens the apache logs do not log any http requests.
Instead when this happens all http requests to my server would be redirected to some weird Trojan website and my Norton Antivirus would show an Alert/Warning, for example;
"Browser exploit at www.xxx.xxx was blocked"
Risk Name: MSIE WebViewFolderIcon ActiveX Control BO
or another error like;
"Auto-Protect has detected Trojan.Fakeavalert".
At first i thought the problem could be with my Laptop/ISP so i logged on to the server via SSH and opened try to open a website using command line "lynx mywebsite.com" and it shows following error;
"Alert!: HTTP/1.0 503 Service Unavailable".
Now if i assume my laptop were to be infected, then as soon as i restart my apache and visit mywebsite.com eveything returns to normal with no such warnings. Why do i see those norton error messages only when apache is down with 503, and when apache is down with 503 how come the http requests always get redirected to some suspicious websites and nothing gets logged in apache error log?
I think my server is being attacked causing http to get unresponsive and thereafter http requests to my server are redirected to some malicious website, is this correct?
Also, i suspect this is a php script exploit as some customers have reported that google have blocked their website due to security reasons, i found <iframe> tage inserted in some php pages which i fixed.
Also, another thinh i noticed;
when apache responds with the 503 it is referencing PHP 5.1.4 in the header response:
[root@]# curl -I xxx.xxx.xxx.xxx (my server ip)
HTTP/1.0 503 Service Unavailable
Server: Apache
X-Powered-By: PHP/5.1.4
Retry-After: 20
I am running PHP 4.3.9m why does apache responds with PHP 5.1.4 when this 503 error surfaces?
Also, since my apache was dowan with 503 error a customer mailed in today saying;
"It seems that my site www.xxxx.com is regularly down, and the winlogon virus is involved."
I suspect this is again due to the fact that http requests start getting redirected?
View 3 Replies
View Related
Feb 8, 2015
So I've got a problem where a small percentage of incoming requests are resulting in "400 bad request" errors and I could really use some input. At first I thought they were just caused by malicious spiders, scrapers, etc. but they seem to be legitimate requests.
I'm running Apache 2.2.15 and mod_perl2.
The first thing I did was turn on mod_logio and interestingly enough, for every request where this happens the request headers are between 8000-9000 bytes, whereas with most requests it's under 1000. Hmm.
There are a lot of cookies being set, and it's happening across all browsers and operating systems, so I assumed it had to be related to bad or "corrupted" cookies somehow - but it's not.
I added "%{Cookie}i" to my LogFormat directive hoping that would provide some clues, but as it turns out half the time the 400 error is returned the client doesn't even have a cookie. Darn.
Next I fired up mod_log_forensic hoping to be able to see ALL the request headers, but as luck would have it nothing is logged when it happens. I guess Apache is returning the 400 error before the forensic module gets to do its logging?
By the way, when this happens I see this in the error log:
request failed: error reading the headers
To me this says Apache doesn't like something about the raw incoming request, rather than a problem with our rewriting, etc. Or am I misunderstanding the error?
I'm at a loss where to go from here. Is there some other way that I can easily see all the request headers? I feel like that's the only thing that will possibly provide a clue as to what's going on.
View 1 Replies
View Related
Jan 21, 2014
I have been trying to solve a big problem for the last 2 weeks with one of our servers.
The client using our system (web based w/ apache and php) is a contact center firm. They have about 120 operators, all connect to our websever with the same IP.
We have been suffering DoS attacks from some of these operators. This are simple, browser attacks , namely 5 or 10 operators will just hold F5 key and bombard the server with requests when they shouldnt.
We did manage to produce a php protection which will recognize the multiple requests and blacklist the user, but its "too late" because the request have already been sent and processed by the webserver.
We use the user ID in the system to control who should be blacklisted, so this is all dependent on our own authentication.
Ideally, we need something EXACTLY like mod_evasive, but for rejecting single requests instead of blocking the IP. Exemplifying : if a user calls the same url, 5 times, in a 3 second spawn, we will reject every next request for 30 seconds, but only the requests by that user.
If the webserver can make any use of it, the user id is stored in a cookie.
View 4 Replies
View Related
Mar 27, 2013
I'm running Apache 2.4.4 on Windows Server 2008 R2. It's already happened many times that Apache stopped responding to requests. The last entry in the error.log:
[Wed Mar 27 06:22:07.043600 2013] [mpm_winnt:notice] [pid 1736:tid 256] AH00354: Child: Starting 64 worker threads.
[Wed Mar 27 06:52:34.521200 2013] [mpm_winnt:error] [pid 1736:tid 1656] AH00326: Server ran out of threads to serve requests. Consider raising the ThreadsPerChild setting
View 1 Replies
View Related
Apr 10, 2015
I'm trying to prevent unnecessary GET requests from being processed by my CMS that originate from mutating IP address locations. This is sucking up server resources when the request is processed by the app, and so if possible, I'd like to block them with HTACCESS so that the request is stopped before anything is intensively-processed.
What happens is that an IP address will make a GET request for, say, "blah/test" or "blah/test2" but nothing else (no site assets like images or CSS/JavaScript files or even other pages). After this request, another IP address will then make an equivalent kind of request, and so on, and so on... All of them have similar if not identical user agent strings but they're always worthless requests that do nothing but waste CPU and RAM. I'm assuming it's just some idiotic SPAM bot because of this.
View 8 Replies
View Related
May 7, 2008
I have a problem. When MSN Search robot looks through my VPS, the machine is going "asleep", e.g. Apache2 (Port 80) doesn't answer at all. Here is the last falling:
Code:
23:14:15 up 4 days, 9:06, 5 users, load average: 37.18, 31.25, 27.46
I hardly ever can enter 'pkill apache2' to kill Apache2 processes. Here is my Apache2 configuration (timeouts, prefork, e.g.):
Code:
Timeout 30
KeepAlive On
MaxKeepAliveRequests 20
KeepAliveTimeout 5
<IfModule mpm_prefork_module>
StartServers 2
MinSpareServers 2
MaxSpareServers 5
MaxClients 10
MaxRequestsPerChild 400
</IfModule>
Maybe I configured Apache2 wrongly, but I only want to prevent this bad thing.
View 2 Replies
View Related
Oct 28, 2008
I seem to be having troubles getting yum to run. The problem occurs when I try to run yum via ssh using putty or install perl modules through whm.
When I try to run it, I generally get:
Loading "fastestmirror" plugin
And nothing after that, even if I wait a while. This happens when I run:
yum update
yum install imagemagick (my current reason for trying to get yum to run)
yum clean all
(probably other yum commands)
If I run yum with --noplugins, it just skips putting out the fastestmirror message.
Some info on my system:
CENTOS Enterprise 5.2
Kernel Version: 2.6.18-92.el5
Intel C2D e6750
WHM 11.23.2
cPanel 11.23.6-R27698
I'm not sure what other information be relevant;
View 7 Replies
View Related
May 26, 2008
What does green and blue color mean? is my total amount of traffic the total of both colors?
View 4 Replies
View Related
May 9, 2007
css $ ls -l /san
ls: reading directory /mountfd: Too many open files
total 0
View 3 Replies
View Related
Mar 30, 2008
We have recently launched a new website with a SSL homepage which houses our login. Our website moved to a new IP address, therefor we moved the certificate to the new server as well. Thus far, we have had NO problems with the site with the exception of 2 MAC users who's browser hangs when they try to navigate to the site now. They can access other HTTPS sites, and they can access pages on OUR site that are NOT HTTPS, but when trying to browse to our HTTPS Page, the browser hangs. This is not just ONE browser on their MAC, it's EVERY broswer on their machine (Firefox, IE, Safari). It connects, but then doesn't load anything onto the screen. We tried clearing their DNS cache on their machines with no avail. To this point, we are stumped. We have identical machines, with idential OS and browser versions and everything tests fine. It is obviously something on their machine, but we don't know what it is. We have run out of ideas. Any MAC users that can lend a hand here? Is there a way to delete the certificate on the MAC and have it redownload to the user?
View 0 Replies
View Related
