I have read that running httpd under user nobody is not safe at all so I installed mod_suhosin and suphp but still the httpd is running under user nobody.
Could anyone suggest me how to check if they are installed good and are they working? I don't know why is this happening
I usually use the "top" command to see what is happening in my server ... Normally everything is OK untill one week ago I start so see this process:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1115 root 20 0 10768 10m 164 R 26 0.5 46:17.27 httpd
Is the number 1 on the top list using a lot of CPU and MEM (as I say before ... I never have seen this command in the past)
So when I kill the process everything goes fine but only for a few minutes and then is comming back
so here is a simple question that i just can't seem to figure out.. when i run the command top or ps -auxw.. they show the httpd processes as the command httpd or /usr/sbin/httpd, but how do i know what file that is? is there anyway to find out what file that is actually getting executed or served?
View 2 Replies View RelatedI had a strange error this morning, httpd was running fine but nothing was loading. All the other services worked fine but I checked the error log and couldn't find anything. I restarted httpd and it's running fine now.
Quote:
[Sat Feb 10 11:48:01 2007] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Sat Feb 10 11:48:01 2007] [notice] Accept mutex: sysvsem (Default: sysvsem)
[Sat Feb 10 13:06:02 2007] [notice] caught SIGTERM, shutting down
[Sat Feb 10 13:06:03 2007] [notice] Apache configured -- resuming normal operations
[Sat Feb 10 13:06:03 2007] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Sat Feb 10 13:06:03 2007] [notice] Accept mutex: sysvsem (Default: sysvsem)
[Sat Feb 10 20:42:26 2007] [notice] caught SIGTERM, shutting down
[Sat Feb 10 20:42:28 2007] [notice] Apache configured -- resuming normal operations
[Sat Feb 10 20:42:28 2007] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Sat Feb 10 20:42:28 2007] [notice] Accept mutex: sysvsem (Default: sysvsem)
Looks just like normal operations... I checked the access log and nothing looked out of the ordinary either.
Anyway the only suspicious thing I saw was the daily scan by spammers to see if I had anything exploitable.
Quote:
[Sat Feb 10 00:16:32 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/a1b2c3d4e5f6g7h8i9/nonexistentfile.php
[Sat Feb 10 00:16:33 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/adxmlrpc.php
[Sat Feb 10 00:16:33 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/adserver/adxmlrpc.php
[Sat Feb 10 00:16:33 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/phpAdsNew/adxmlrpc.php
[Sat Feb 10 00:16:33 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/phpadsnew/adxmlrpc.php
[Sat Feb 10 00:16:33 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/phpads/adxmlrpc.php
[Sat Feb 10 00:16:33 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/Ads/adxmlrpc.php
[Sat Feb 10 00:16:33 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/ads/adxmlrpc.php
[Sat Feb 10 00:16:33 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/xmlrpc.php
[Sat Feb 10 00:16:34 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/xmlrpc/xmlrpc.php
[Sat Feb 10 00:16:34 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/xmlsrv/xmlrpc.php
[Sat Feb 10 00:16:34 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/blog/xmlrpc.php
[Sat Feb 10 00:16:34 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/drupal/xmlrpc.php
[Sat Feb 10 00:16:34 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/community/xmlrpc.php
[Sat Feb 10 00:16:34 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/blogs/xmlrpc.php
[Sat Feb 10 00:16:34 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/blogs/xmlsrv/xmlrpc.php
[Sat Feb 10 00:16:34 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/blog/xmlsrv/xmlrpc.php
[Sat Feb 10 00:16:34 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/blogtest/xmlsrv/xmlrpc.php
[Sat Feb 10 00:16:35 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/b2/xmlsrv/xmlrpc.php
[Sat Feb 10 00:16:35 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/b2evo/xmlsrv/xmlrpc.php
[Sat Feb 10 00:16:35 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/wordpress/xmlrpc.php
[Sat Feb 10 00:16:35 2007] [error] [client 69.13.76.82] File does not exist: /var/www/html/phpgroupware/xmlrpc.php
I have nothing to be exploited so I'm thinking that wasn't the cause either.
I checked user_beancounters and there are also 0 fail counts.
Quote:
Version: 2.5
uid resource held maxheld barrier limit failcnt
509: kmemsize 4679572 9150217 50000000 50000000 0
lockedpages 0 0 256 256 0
privvmpages 51822 84271 262140 524280 0
shmpages 10913 10929 21504 21504 0
dummy 0 0 0 0 0
numproc 52 91 400 400 0
physpages 14273 24587 0 2147483647 0
vmguarpages 0 0 131070 2147483647 0
oomguarpages 14912 33040 26112 2147483647 0
numtcpsock 16 146 360 360 0
numflock 1 6 188 206 0
numpty 2 2 16 16 0
numsiginfo 0 25 256 256 0
tcpsndbuf 154284 371176 1720320 2703360 0
tcprcvbuf 197308 539932 1720320 2703360 0
othersockbuf 13416 239892 1126080 2097152 0
dgramrcvbuf 0 2800 262144 262144 0
numothersock 13 27 360 360 0
dcachesize 0 0 2273280 2416640 0
numfile 1199 2022 5820 5820 0
dummy 0 0 0 0 0
dummy 0 0 0 0 0
dummy 0 0 0 0 0
numiptent 89 89 128 128 0
Code:
[root@serwer /]# httpd restart
/usr/sbin/httpd restart: httpd not running, trying to start
/usr/sbin/httpd restart: httpd could not be started
Code:
[root@serwer /]# httpd status
Looking up localhost
Making HTTP connection to localhost
Alert!: Unable to connect to remote host.
lynx: Can't access startfile [url]
I can access FTP, SSH and httpd is showed as running when i check with 'httpd status'. Memory ram has half of them left(except that swap is 0,0).
I can't access my site via browser
Why tried restarting
[root@web2 ~]# service httpd start
Starting httpd: (98)Address already in use: make_sock: could not bind to address [::]:80
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
[FAILED]
[root@web2 ~]#
I trying:
Code:
[root@serwer /]# httpd restart
/usr/sbin/httpd restart: httpd not running, trying to start
/usr/sbin/httpd restart: httpd could not be started
Code:
[root@serwer /]# /etc/rc.d/init.d/httpd configtest
Syntax OK
Help
I am pretty sure that the following entries in the logs are not good and I would like to resolve this issue. I have been reading on Google for several hours straight looking for answers and have come up short.
[/var/log]# grep -i -C4 failed maillog | tail -18
Jul 29 10:12:29 bamboo spamd[31310]: spamd: setuid to root succeeded
Jul 29 10:12:29 bamboo spamd[31310]: spamd: still running as root: user not specified with -u, not found, or set to root, falling back to nobody
Jul 29 10:12:29 bamboo spamd[31310]: spamd: processing message <GTUBE1.1010101@example.net> for root:99
Jul 29 10:12:29 bamboo spamd[31310]: auto-whitelist: open of auto-whitelist file failed: locker: safe_lock: cannot create tmp lockfile /.spamassassin/auto-whitelist.lock.bamboo.site.com.31310 for /.spamassassin/auto-whitelist.lock: No such file or directory
Jul 29 10:12:29 bamboo spamd[31310]: spamd: identified spam (1000.0/5.0) for root:99 in 0.0 seconds, 834 bytes.
Jul 29 10:12:29 bamboo spamd[31310]: spamd: result: Y 999 - GTUBE,NO_RECEIVED,NO_RELAYS ....
I have 3 questions.
1.) I have a user that's kinda knows a lot about linux. More than me. He has a lot of stuff on the system which I have no idea what it is. Is there any way I can install a SSH log, so I can monitor what he does in shell?
2.) My server seems REALLY sluggish. I ran a top in shell, and mysqld was taking up from 70% to 110% of the cpu. Is there any way to fix this or find out why? I've restarted the server, and it's fluctuating between 50% and 90% now.
3.) I think this MIGHT be related to the sqld issue, but I've received about 12 emails saying
Quote:
"[statscheck] Stats/Server Overload on my server". "MPORTANT: Do not ignore this email.
This is cPanel stats runner on server1.cewxp.com!
While processing the log files for user cewxp, the cpu has been
maxed out for more than a 6 hour period. The current load/uptime line on the server at the time of this email is 15:49:16 up 5 days, 10:52, 2 users, load average: 27.59, 31.36, 31.83"
and also another email
Quote:
IMPORTANT: Do not ignore this email.
This is cPanel stats runner on server1.cewxp.com!
While processing the log files for user vegapunk, the cpu has been maxed out for more than a 6 hour period. The current load/uptime line on the server at the time of this email is 12:34:26 up 5 days, 7:37, 2 users, load average: 19.90, 17.59, 17.97
Running programs named Perl with Heavy CPU usage, with the ownership of user apache.
We found the problem on Fedora 3 and Fedora 6.
In our case, it was the result of a Trojan activity.
Quick Solution
Check the cron jobs of user apache
crontab -u apache -e
*/1 * * * * perl /tmp/.tmp/tmpfile
delete the cronjob entry.
Also delete the file /tmp/.tmp/tmpfile
also added "apache" to the file /etc/cron.deny
That's all
Problem and solution in detail....
I thought I knew enough about my .htaccess stuff to do this, but I can't seem to work it out. What I want to do is if a user visits domain.com/folder, we check to see if the folder exists. If so, show as normal (IE domain.com/support)
If a user visits domain.com/dynamicusername (dynamicusername is not a physical folder), redirect to dynamicusername.domain.com
i am using seperate server for sql .But my httpd server failed many time when i checked maximum number of httpd connection then my sql server using too many connection what is the reason of this problem . Is my sql server using as a slave in a ddos attack or sql server need http connection?
View 2 Replies View Relatedwhen I find the subscription from the admin side of PPA, if I select "Login as user" I've noticed that it is different from actually logging in as the user - for example - "add domain alias" is missing when I login as a customer - but not as an admin... I need my customers to add their own aliases and manage them - how do I add that feature to the client login side?
View 9 Replies View RelatedCpanel with Cent os
i have creat my new user and upload his files on it. but when i try this link:
http://ip/~user
i have this error and my friend say that your httpd have problem. but its my new server. how can i solve it ?
404 Not Found
The server can not find the requested page:
ip/~user (port 80)
Please forward this error screen to 69.197.166.71's WebMaster.
Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8b mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8 Server at 69.197.166.71 Port 80
i try it with his doamin and i have same error.
I have 1764 pid started by httpd daemon. I think for some reason the httpd pid is not closing for me. How do i make sure that all of the httpd pid are closing.
View 2 Replies View RelatedI know that there are a lot of posts about this but... i have a problem w my apache... it was working fine until today... i get this e-mail from WHM whenever httpd fails... and its pretty often:
Quote:
httpd failed @ Mon Aug 18 16:23:13 2008. A restart was attempted automagically.
Failure Reason: Timeout while trying to connect to service
I wanna know how to check in the error log the entries of just today. because when i put "cat error_log" i start receiving things from last week and this is happening today...
i've tried /scripts/rebuildhttpdconf and then restarted, but still the same.
I just got apache installed on my box and the process is running. However when I enter my ip address on firefox, nothing loads up and I get a timeout error.
View 8 Replies View RelatedI did a Graceful Server Reboot, but it seems httpd service not running yet,
I got this error after try to restart Apache..
"
Restarting Apache Web Server
Waiting for httpd to restart..............finished.
httpd (/usr/local/cpanel/whostmgr/bin/whostmgr ./reshttpd) running as root with PID 3319
httpd has failed, please contact the sysadmin.
"
and my Log:
[root@XXXXX ~]# tail -f /usr/local/apache/logs/error_log
Failed to start up concurrent users module!
[Sat Jul 25 20:39:51 2009] [notice] suEXEC mechanism enabled (wrapper: /usr/loca l/apache/bin/suexec)
[Sat Jul 25 20:39:52 2009] [warn] pid file /usr/local/apache/logs/httpd.pid over written -- Unclean shutdown of previous Apache run?
[Sat Jul 25 20:39:52 2009] [crit] (28)No space left on device: Unable to create or access scoreboard (anonymous shared memory failure)
shmget() failed: No space left on device ....
I just stop httpd service for server maintainance , and disable its monitoring from whm services, but after some time it again start even i disable httpd monitoring and service.
View 6 Replies View RelatedMy httpd server continuosly failing i have to set or restart it manually how can i set auto incase if its restart failed.
View 11 Replies View RelatedI moved a domain of mine from one of my CentOS servers on my SoHo LAN, to one of my CentOS cPanel/WHM servers. Since the SoHo machine had been handling this domain's mail for almost 2 years (300+ mb of mail), I decided to continue running it from home.
The Apache daemon was stopped on said SoHo box following DNS propagation to the cPanel machine, but Apache was automatically started again after having to reboot the SoHo server. Before I got a chance to kill Apache, I got some weird entries showin' up in the access_logs.
www.####.com ip54520165.adsl-surfen.hetnet.nl - - [15/Apr/2009:23:30:20 -0700] "CONNECT 205.188.179.233:443 HTTP/1.0" 302 286 "-" "-"
www.####.com ip54520165.adsl-surfen.hetnet.nl - - [15/Apr/2009:23:37:05 -0700] "CONNECT 205.188.176.230:443 HTTP/1.0" 302 286 "-" "-"
www.####.com ip54520165.adsl-surfen.hetnet.nl - - [15/Apr/2009:23:43:30 -0700] "CONNECT 205.188.153.99:443 HTTP/1.0" 302 285 "-" "-"
www.####.com ip54520165.adsl-surfen.hetnet.nl - - [16/Apr/2009:00:10:01 -0700] "CONNECT 205.188.153.100:443 HTTP/1.0" 302 286 "-" "-"
I ask simply because I don't recall seeing a "CONNECT" entry in my logs before, and I've been at this for awhile. That or I've just not paid any attention. And what's with the SSL port?
I guess I'm just a little confused as to what was trying to be accomplished here...it hasn't returned since.
right ive got a server thats getting battered at the moment by lots of apache processes, ive moved sql off to a seperate box (with private lan so thats fine) but now i need to optimize/replace apache with something less intensive on resources, only problem is im using plesk on this server so i am not sure if i can change the webserver app?
using apache 2.2 with prefork mpm
server specs
Athlon 64 3200+
4gb DDR2
120Gb HD
How can I prevent the httpd from timeout so much? the server recovers which is prefectly fine but there seems to be a problem some where.
httpd failed @ Sat Oct 31 17:47:53 2009. A restart was attempted automagically.
Service Check Method: [tcp connect]
Failure Reason: Timeout while trying to get data from service
had alot of trouble installing YUM
but anyways...
Restarting Apache Web Server
Waiting for httpd to restart..............finished.
httpd (/usr/local/cpanel/whostmgr/bin/whostmgr ./reshttpd) running as root with PID 20104
httpd has failed, please contact the sysadmin.
Trying to troubleshoot an exploit where the code redirecting people to exploit sites is not in the website. I think a module is being loaded dynamically, but I am not seeing the entry point in the access logs. I restart httpd and the problem goes away temporarily.
Anyone see anything fishy?
==================
HTTPD MODULES
==================
[root@xxx ~]# httpd -L
<Directory (core.c)
Container for directives affecting resources located in the specified directories
Allowed in *.conf only outside <Directory>, <Files> or <Location>
<Location (core.c)
Container for directives affecting resources accessed through the specified URL paths
Allowed in *.conf only outside <Directory>, <Files> or <Location>
<VirtualHost (core.c)
Container to map directives to a particular virtual host, takes one or more host addresses
Allowed in *.conf only outside <Directory>, <Files> or <Location>
<Files (core.c)
Container for directives affecting files matching specified patterns
Allowed in *.conf anywhere and in .htaccess
when AllowOverride isn't None
<Limit (core.c)
Container for authentication directives when accessed using specified HTTP methods
Allowed in *.conf anywhere and in .htaccess
when AllowOverride isn't None
<LimitExcept (core.c)
Container for authentication directives to be applied when any HTTP method other than those specified is used to access the resource
Allowed in *.conf anywhere and in .htaccess
when AllowOverride isn't None
<IfModule (core.c)
Container for directives based on existance of specified modules
Allowed in *.conf anywhere and in .htaccess
when AllowOverride isn't None
<IfDefine (core.c)
Container for directives based on existance of command line defines
Allowed in *.conf anywhere and in .htaccess
when AllowOverride isn't None
<DirectoryMatch (core.c)
Container for directives affecting resources located in the specified directories
Allowed in *.conf only outside <Directory>, <Files> or <Location>
<LocationMatch (core.c)
Container for directives affecting resources accessed through the specified URL paths
Allowed in *.conf only outside <Directory>, <Files> or <Location>
<FilesMatch (core.c)
Container for directives affecting files matching specified patterns
Allowed in *.conf anywhere and in .htaccess
when AllowOverride isn't None
AuthType (core.c)
An HTTP authorization type (e.g., "Basic")
Allowed in *.conf only inside <Directory>, <Files> or <Location> and in .htaccess
when AllowOverride includes AuthConfig
AuthName (core.c)
The authentication realm (e.g. "Members Only")
Allowed in *.conf only inside <Directory>, <Files> or <Location> and in .htaccess
when AllowOverride includes AuthConfig
Require (core.c)
Selects which authenticated users or groups may access a protected space
Allowed in *.conf only inside <Directory>, <Files> or <Location> and in .htaccess
when AllowOverride includes AuthConfig
Satisfy (core.c)
access policy if both allow and require used ('all' or 'any')
Allowed in *.conf only inside <Directory>, <Files> or <Location> and in .htaccess
when AllowOverride includes AuthConfig
AddDefaultCharset (core.c)
The name of the default charset to add to any Content-Type without one or 'Off' to disable
Allowed in *.conf anywhere and in .htaccess
when AllowOverride includes FileInfo
AcceptPathInfo (core.c)
Set to on or off for PATH_INFO to be accepted by handlers, or default for the per-handler preference
Allowed in *.conf anywhere and in .htaccess
when AllowOverride includes FileInfo
AccessFileName (core.c)
Name(s) of per-directory config files (default: .htaccess)
Allowed in *.conf only outside <Directory>, <Files> or <Location>
DocumentRoot (core.c)
Root directory of the document tree
Allowed in *.conf only outside <Directory>, <Files> or <Location>
ErrorDocument (core.c)
Change responses for HTTP errors
Allowed in *.conf anywhere and in .htaccess
when AllowOverride includes FileInfo
AllowOverride (core.c)
Controls what groups of directives can be configured by per-directory config files
Allowed in *.conf only inside <Directory>, <Files> or <Location>
Options (core.c)
Set a number of attributes for a given directory
Allowed in *.conf anywhere and in .htaccess
when AllowOverride includes Options
DefaultType (core.c)
the default MIME type for untypable files
Allowed in *.conf anywhere and in .htaccess
when AllowOverride includes FileInfo...
i have two servers behind certain switch,
the two servers are with low load,
but the one is good response,and another one is slow,
i try to restart the httpd,the problem is here still,
are there any method that i can optimize the httpd and check out why it is ?
they all run with whm/cpanel
I have 3.0 pentium with 2Gb RAM... It's the first time I use plesk and this is strange...
top - 23:20:00 up 2:42, 1 user, load average: 9.87, 13.60, 10.29
Tasks: 149 total, 29 running, 120 sleeping, 0 stopped, 0 zombie
Cpu(s): 93.9% us, 6.1% sy, 0.0% ni, 0.0% id, 0.0% wa, 0.0% hi, 0.0% si
Mem: 2064724k total, 1208656k used, 856068k free, 46252k buffers
Swap: 522104k total, 0k used, 522104k free, 354784k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
2354 mysql 20 0 290m 90m 4500 S 12.6 4.5 21:08.10 mysqld
29098 apache 20 0 44140 23m 4352 R 8.0 1.2 0:02.20 httpd
28621 apache 20 0 41560 23m 4360 R 7.3 1.1 0:06.38 httpd
28855 apache 20 0 43992 23m 4356 R 7.3 1.2 0:06.28 httpd
29252 apache 20 0 34672 15m 3344 R 7.3 0.8 0:00.22 httpd
27117 apache 20 0 44632 24m 4692 S 6.6 1.2 0:19.58 httpd
28517 apache 20 0 44196 23m 4500 R 6.6 1.2 0:10.76 httpd
28930 apache 20 0 44272 23m 4504 R 6.6 1.2 0:06.16 httpd
28994 apache 20 0 42756 22m 4396 R 6.6 1.1 0:03.12 httpd
29026 apache 20 0 43584 23m 4700 R 6.6 1.1 0:04.04 httpd
29173 apache 20 0 41212 22m 3708 R 6.6 1.1 0:01.86 httpd
29194 apache 20 0 41056 21m 3756 R 6.6 1.1 0:01.08 httpd
29229 apache 20 0 38132 18m 3668 R 6.6 0.9 0:01.04 httpd
29232 apache 20 0 42876 22m 4344 R 6.6 1.1 0:01.08 httpd
29236 apache 20 0 36708 17m 3728 R 6.6 0.9 0:00.74 httpd
28564 apache 20 0 44300 23m 4712 R 6.0 1.2 0:08.96 httpd
28926 apache 20 0 44228 23m 4408 R 6.0 1.2 0:04.44 httpd
29063 apache 20 0 43588 22m 4336 R 6.0 1.1 0:03.40 httpd
29073 apache 20 0 43944 23m 4388 R 6.0 1.2 0:03.94 httpd
29172 apache 20 0 41056 21m 3752 R 6.0 1.1 0:01.50 httpd
29192 apache 20 0 44704 24m 4408 R 6.0 1.2 0:03.20 httpd
29237 apache 20 0 37100 18m 3660 R 6.0 0.9 0:00.64 httpd
29254 apache 20 0 33432 14m 3340 R 6.0 0.7 0:00.18 httpd
29228 apache 20 0 35056 16m 3656 S 5.3 0.8 0:00.36 httpd
29105 apache 20 0 44744 24m 4452 R 4.7 1.2 0:04.74 httpd
29106 apache 20 0 43908 23m 4548 R 4.7 1.2 0:05.36 httpd
29193 apache 20 0 35124 16m 3652 R 4.7 0.8 0:00.68 httpd
29195 apache 20 0 43324 22m 4332 S 4.7 1.1 0:01.36 httpd
28551 apache 20 0 44240 23m 4596 R 4.0 1.2 0:10.64 httpd
28727 apache 20 0 44012 23m 4492 S 4.0 1.2 0:08.70 httpd
29223 apache 20 0 44048 23m 4428 S 3.3 1.2 0:01.26 httpd
29224 apache 20 0 43236 22m 4328 S 2.0 1.1 0:01.06 httpd
29219 apache 20 0 35108 16m 3648 S 1.3 0.8 0:00.70 httpd
29259 apache 20 0 28860 9816 3296 R 1.3 0.5 0:00.04 httpd
29260 apache 20 0 28464 9476 3284 R 1.3 0.5 0:00.04 httpd
I have some webs with 30K/40K visits each day (it's not too much)... A smaller CPU with 1Gb RAM with cPanel and Apache 1.3 worked perfectly, and now with a bigger computer and plesk I see this...
More info on server-status
Server Version: Apache/2.0.54 (Fedora)
Server Built: Jul 26 2006 11:00:19
Current Time: Monday, 28-Apr-2008 23:40:53 CEST
Restart Time: Monday, 28-Apr-2008 23:25:38 CEST
Parent Server Generation: 0
Server uptime: 15 minutes 14 seconds
Total accesses: 13025 - Total Traffic: 44.9 MB
CPU Usage: u1183.04 s50.79 cu.01 cs0 - 135% CPU load
14.3 requests/sec - 50.3 kB/second - 3616 B/request
34 requests currently being processed, 67 idle workers
C_C_C_____W__C_WC__WCW_W_R______C____W_W_W._W.___W W____WC.CC___W
___W__WC_W__W_________W__..WW_W.___W____._.__..... ..............
.................................................. ..............
.................................................. ........
In My server i Can see lotz of /usr/local/apache/bin/httpd -k start -DSSL Process also some time it lead to crash of my server,is this caused to improper httpd.con file iam have 200-250 online users here i will give my apachi cofig file
KeepAlive Off
MaxKeepAliveRequests 200
KeepAliveTimeout 15
StartServers 20
MinSpareServers 30
MaxSpareServers 40
MaxClients 600
MaxRequestsPerChild 250
in correct optimization for my apachi also my processer is dual xenon
It seems to be common that in httpd status in Apache 2.x except real connections you can also see multiple connections from www.example.com
Is it a bug and if not is there a way to make httpd status to not show those www.example.com connections?
I have httpd down right now without any error outputted on errors_log
my server is with 4 Quad-Core Intel Xeon 2.66GHz (16 CPu) and 16GB of RAM. Is running CentOS Linux 5.1 and Apache/2.2.8. The site that will be running in this server has an average of 360,000 pageviews daily, so we want to make sure to tweak the configuration at its best.
my httpd.Conf:
Include "/usr/local/apache/conf/includes/pre_main_global.conf"
Include "/usr/local/apache/conf/includes/pre_main_2.conf"
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# Direct modifications to the Apache configuration file may be lost upon subsequent regeneration of the #
# configuration file. To have modifications retained, all modifications must be checked into the #
# configuration system by running: #
# /usr/local/cpanel/bin/apache_conf_distiller --update #
# To see if your changes will be conserved, regenerate the Apache configuration file by running: #
# /usr/local/cpanel/bin/build_apache_conf #
# and check the configuration file for your alterations. If your changes have been ignored, then they will #
# need to be added directly to their respective template files. #
# #
# It is also possible to add custom directives to the various "Include" files loaded by this httpd.conf #
# For detailed instructions on using Include files and the apache_conf_distiller with the new configuration #
# system refer to the documentation at: [url] #
# #
# This configuration file was built from the following templates: #
# /var/cpanel/templates/apache2/main.default #
# /var/cpanel/templates/apache2/main.local #
# /var/cpanel/templates/apache2/vhost.default #
# /var/cpanel/templates/apache2/vhost.local #
# /var/cpanel/templates/apache2/ssl_vhost.default #
# /var/cpanel/templates/apache2/ssl_vhost.local #
# #
# Templates with the '.local' extension will be preferred over templates with the '.default' extension. #
# The only template updated by the apache_conf_distiller is main.default. #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
LoadModule auth_passthrough_module modules/mod_auth_passthrough.so
LoadModule bwlimited_module modules/mod_bwlimited.so
LoadModule frontpage_module modules/mod_frontpage.so
LoadModule bw_module modules/mod_bw.so
LoadModule evasive20_module modules/mod_evasive20.so
Include "/usr/local/apache/conf/php.conf"
Include "/usr/local/apache/conf/mod_bandwidth.conf"
LoadModule security2_module modules/mod_security2.so
#Include "/etc/httpd/conf/modsecurity.conf"
ErrorLog "logs/error_log"
DefaultType text/plain
<Directory "/">
Options All
AllowOverride All
</Directory>
<Directory "/usr/local/apache/htdocs">
Options Includes Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
<Files ~ "^error_log$">
Order allow,deny
Deny from all
Satisfy All
</Files>
<FilesMatch "^.ht">
Order allow,deny
Deny from all
Satisfy All
</FilesMatch>
<IfModule log_config_module>
LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined
LogFormat "%h %l %u %t "%r" %>s %b" common
CustomLog "logs/access_log" common
<IfModule logio_module>
LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i" %I %O" combinedio
</IfModule>
</IfModule>
<IfModule alias_module>
ScriptAlias /cgi-bin/ "/usr/local/apache/cgi-bin/"
</IfModule>
<Directory "/usr/local/apache/cgi-bin">
AllowOverride None
Options None
Order allow,deny
Allow from all
</Directory>
<IfModule mime_module>
TypesConfig conf/mime.types
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
</IfModule>
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# Direct modifications to the Apache configuration file may be lost upon subsequent regeneration of the #
# configuration file. To have modifications retained, all modifications must be checked into the #
# configuration system by running: #
# /usr/local/cpanel/bin/apache_conf_distiller --update #
# To see if your changes will be conserved, regenerate the Apache configuration file by running: #
# /usr/local/cpanel/bin/build_apache_conf #
# and check the configuration file for your alterations. If your changes have been ignored, then they will #
# need to be added directly to their respective template files. #
# #
# It is also possible to add custom directives to the various "Include" files loaded by this httpd.conf #
# For detailed instructions on using Include files and the apache_conf_distiller with the new configuration #
# system refer to the documentation at: [url]#
# #
# This configuration file was built from the following templates: #
# /var/cpanel/templates/apache2/main.default #
# /var/cpanel/templates/apache2/main.local #
# /var/cpanel/templates/apache2/vhost.default #
# /var/cpanel/templates/apache2/vhost.local #
# /var/cpanel/templates/apache2/ssl_vhost.default #
# /var/cpanel/templates/apache2/ssl_vhost.local #
# #
# Templates with the '.local' extension will be preferred over templates with the '.default' extension. #
# The only template updated by the apache_conf_distiller is main.default. #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
PidFile logs/httpd.pid
LockFile logs/accept.lock
# Defined in /var/cpanel/cpanel.config: apache_port
Listen 0.0.0.0:80
Timeout 300
User nobody
Group nobody
ExtendedStatus On
ServerAdmin soso@soso.com
ServerName server.soso.org
LogLevel warn
ServerSignature Off
RewriteMap LeechProtect prg:/usr/local/cpanel/bin/leechprotect
RewriteLock /usr/local/apache/logs/rewrite_lock
UserDir public_html
DirectoryIndex index.html.var index.htm index.html index.shtml index.xhtml index.wml index.perl index.pl index.plx index.ppl index.cgi index.jsp index.js index.jp index.php4 index.php3 index.php index.phtml default.htm default.html home.htm index.php5 Default.html Default.htm home.html
SSLPassPhraseDialog builtin
SSLSessionCache dbm:/usr/local/apache/logs/ssl_scache
SSLSessionCacheTimeout 300
SSLMutex file:/usr/local/apache/logs/ssl_mutex
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
<IfDefine SSL>
# Defined in /var/cpanel/cpanel.config: apache_ssl_port
Listen 0.0.0.0:443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
</IfDefine>
#AddHandler cgi-script .cgi .pl .plx .ppl .perl
AddHandler server-parsed .shtml
AddType text/html .shtml
AddType application/x-tar .tgz
AddType text/vnd.wap.wml .wml
AddType image/vnd.wap.wbmp .wbmp
AddType text/vnd.wap.wmlscript .wmls
AddType application/vnd.wap.wmlc .wmlc
AddType application/vnd.wap.wmlscriptc .wmlsc
<Location /whm-server-status>
SetHandler server-status
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Location>
# SUEXEC is supported
Include "/usr/local/apache/conf/includes/pre_virtualhost_global.conf"
Include "/usr/local/apache/conf/includes/pre_virtualhost_2.conf"
# DO NOT EDIT. AUTOMATICALLY GENERATED. IF YOU NEED TO MAKE A CHANGE PLEASE USE THE INCLUDE FILES.
NameVirtualHost *
# Default vhost for unbound IPs
<VirtualHost *>
ServerName server.soso.org
DocumentRoot /usr/local/apache/htdocs
ServerAdmin soso@soso.com
<IfModule mod_suphp.c>
suPHP_UserGroup nobody nobody
</IfModule>
</VirtualHost>
# DO NOT EDIT. AUTOMATICALLY GENERATED. IF YOU NEED TO MAKE A CHANGE PLEASE USE THE INCLUDE FILES.
# SSL
<IfDefine SSL>
</IfDefine>
# DO NOT EDIT. AUTOMATICALLY GENERATED. IF YOU NEED TO MAKE A CHANGE PLEASE USE THE INCLUDE FILES.
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 7
DOSSiteCount 100
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 300
</IfModule>
NameVirtualHost xxx.xxx.152.250:80
<VirtualHost xxx.xxx.152.250:80>
ServerName soso.org
ServerAlias soso.com www.soso.com
ServerAlias eco.soso.org www.eco.soso.org
ServerAlias soso.info www.soso.info
ServerAlias soso.biz www.soso.biz
ServerAlias soso.cc www.soso.cc
ServerAlias www.soso.org
DocumentRoot /home/soso/public_html
ServerAdmin webmaster@soso.org
## User soso # Needed for Cpanel::ApacheConf
<IfModule mod_suphp.c>
suPHP_UserGroup soso soso
</IfModule>
<IfModule concurrent_php.c>
php4_admin_value open_basedir "/home/soso:/usr/lib/php:/usr/php4/lib/php:/usr/local/lib/php:/usr/local/php4/lib/php:/tmp"
php5_admin_value open_basedir "/home/soso:/usr/lib/php:/usr/local/lib/php:/tmp"
</IfModule>
<IfModule !concurrent_php.c>
<IfModule mod_php4.c>
php_admin_value open_basedir "/home/soso:/usr/lib/php:/usr/php4/lib/php:/usr/local/lib/php:/usr/local/php4/lib/php:/tmp"
</IfModule>
<IfModule mod_php5.c>
php_admin_value open_basedir "/home/soso:/usr/lib/php:/usr/local/lib/php:/tmp"
</IfModule>
<IfModule sapi_apache2.c>
php_admin_value open_basedir "/home/soso:/usr/lib/php:/usr/php4/lib/php:/usr/local/lib/php:/usr/local/php4/lib/php:/tmp"
</IfModule>
</IfModule>
<IfModule !mod_disable_suexec.c>
SuexecUserGroup soso soso
</IfModule>
CustomLog /usr/local/apache/domlogs/soso.org-bytes_log "%{%s}t %I .
%{%s}t %O ."
CustomLog /usr/local/apache/domlogs/soso.org combined
</VirtualHost>
ErrorDocument 400 /400.shtml
ErrorDocument 401 /401.shtml
ErrorDocument 403 /403.shtml
ErrorDocument 404 /404.shtml
ErrorDocument 500 /500.shtml
Alias /bandwidth/ /usr/local/bandmin/htdocs/
Alias /sys_cpanel/ /usr/local/cpanel/sys_cpanel/
Alias /java-sys/ /usr/local/cpanel/java-sys/
Alias /img-sys/ /usr/local/cpanel/img-sys/
Alias /akopia/ /usr/local/cpanel/3rdparty/interchange/share/akopia/
Alias /neo-images/ /usr/local/cpanel/base/neomail/neo-images/
Alias /mailman/archives/ /usr/local/cpanel/3rdparty/mailman/archives/public/
Alias /pipermail/ /usr/local/cpanel/3rdparty/mailman/archives/public/
Alias /interchange/ /usr/local/cpanel/3rdparty/interchange/share/interchange/
Alias /interchange-5/ /usr/local/cpanel/3rdparty/interchange/share/interchange-5/
ScriptAlias /cgi-sys/ /usr/local/cpanel/cgi-sys/
ScriptAlias /mailman/ /usr/local/cpanel/3rdparty/mailman/cgi-bin/
ScriptAliasMatch ^/?cpanel/?$ /usr/local/cpanel/cgi-sys/redirect.cgi
ScriptAliasMatch ^/?securecpanel/?$ /usr/local/cpanel/cgi-sys/sredirect.cgi
ScriptAliasMatch ^/?kpanel/?$ /usr/local/cpanel/cgi-sys/redirect.cgi
ScriptAliasMatch ^/?controlpanel/?$ /usr/local/cpanel/cgi-sys/redirect.cgi
ScriptAliasMatch ^/?securecontrolpanel/?$ /usr/local/cpanel/cgi-sys/sredirect.cgi
ScriptAliasMatch ^/?webmail/?$ /usr/local/cpanel/cgi-sys/wredirect.cgi
ScriptAliasMatch ^/?whm/?$ /usr/local/cpanel/cgi-sys/whmredirect.cgi
ScriptAliasMatch ^/?securewhm/?$ /usr/local/cpanel/cgi-sys/swhmredirect.cgi
Include "/usr/local/apache/conf/includes/post_virtualhost_global.conf"
Include "/usr/local/apache/conf/includes/post_virtualhost_2.conf"
-------------------------------------------------------------------------------------------------------------
my.cnf
[mysqld]
set-variable=local-infile=0
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
safe-show-database
old_passwords
back_log = 75
skip-innodb
max_connections = 1500
key_buffer = 1024M
myisam_sort_buffer_size = 64M
join_buffer_size = 1M
read_buffer_size = 1M
sort_buffer_size = 2M
table_cache = 4000
thread_cache_size = 512
wait_timeout = 14400
connect_timeout = 10
tmp_table_size = 64M
max_heap_table_size = 64M
max_allowed_packet = 64M
net_buffer_length = 16384
max_connect_errors = 10
thread_concurrency = 32
read_rnd_buffer_size = 786432
bulk_insert_buffer_size = 8M
query_cache_limit = 5M
query_cache_size = 144M
query_cache_type = 1
query_prealloc_size = 262144
query_alloc_block_size = 65536
transaction_alloc_block_size = 8192
transaction_prealloc_size = 4096
default-storage-engine = MyISAM
[mysqld_safe]
err-log=/var/log/mysqld.log
pid-file=/var/lib/mysql/mysql.pid
nice = -10
open_files_limit = 8192
[mysqldump]
quick
max_allowed_packet = 64M
[myisamchk]
key_buffer = 1024M
sort_buffer = 384M
read_buffer = 256M
write_buffer = 256M
[mysqlhotcopy]
interactive-timeout
-----------------------------------------------------------------------
top :
------------------------------------------------------------------------
top - 18:27:31 up 2:51, 2 users, load average: 1.91, 2.55, 2.58
Tasks: 533 total, 2 running, 531 sleeping, 0 stopped, 0 zombie
Cpu(s): 7.0%us, 3.6%sy, 0.0%ni, 89.1%id, 0.1%wa, 0.0%hi, 0.2%si, 0.0%st
Mem: 16632148k total, 2014536k used, 14617612k free, 102904k buffers
Swap: 4192924k total, 0k used, 4192924k free, 737684k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
22527 mysql 5 -10 1228m 174m 3040 S 81 1.1 22:52.61 mysqld
3717 nobody 16 0 31248 13m 4052 S 6 0.1 0:01.08 httpd
3680 nobody 16 0 31380 13m 4060 R 4 0.1 0:03.07 httpd
3748 nobody 15 0 31044 13m 4052 S 4 0.1 0:01.02 httpd
3687 nobody 15 0 31324 13m 4064 S 4 0.1 0:01.53 httpd
3774 nobody 16 0 31324 13m 4056 S 4 0.1 0:00.72 httpd
3797 nobody 15 0 31324 13m 4060 S 4 0.1 0:02.20 httpd
3850 nobody 15 0 31380 13m 4068 S 4 0.1 0:02.11 httpd
3858 nobody 15 0 31020 13m 4060 S 4 0.1 0:02.91 httpd
3861 nobody 16 0 31252 13m 4116 S 4 0.1 0:01.46 httpd
3900 nobody 15 0 31332 13m 4056 S 4 0.1 0:01.22 httpd
3649 nobody 15 0 31316 13m 4060 S 3 0.1 0:01.06 httpd
3696 nobody 15 0 31020 13m 4052 S 3 0.1 0:01.20 httpd
3654 nobody 15 0 31308 13m 4124 S 3 0.1 0:02.05 httpd
3707 nobody 16 0 31552 13m 4060 S 3 0.1 0:02.03 httpd
3711 nobody 15 0 31072 13m 4060 S 3 0.1 0:02.52 httpd
3790 nobody 15 0 31376 13m 4064 S 3 0.1 0:02.00 httpd
3794 nobody 15 0 31048 13m 4060 S 3 0.1 0:01.10 httpd
3897 nobody 15 0 30764 13m 4404 S 3 0.1 0:01.76 httpd
3907 nobody 15 0 31316 13m 4060 S 3 0.1 0:02.35 httpd
3884 nobody 15 0 31156 13m 4056 S 2 0.1 0:00.99 httpd
3664 nobody 15 0 31308 13m 4060 S 2 0.1 0:01.97 httpd
3838 nobody 15 0 31340 13m 4056 S 2 0.1 0:00.88 httpd
--------------------------------------------------------------------------------------------------
root@server [~]# netstat -lpan | grep :80 | wc -l
1657
root@server [~]#
----------------------------------------------------------------------------------------------
what to change to optimize this web server and solv this problem?