Return-Path: Delivered-To: apmail-httpd-users-archive@www.apache.org Received: (qmail 41239 invoked from network); 10 Sep 2007 13:18:43 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2) by minotaur.apache.org with SMTP; 10 Sep 2007 13:18:43 -0000 Received: (qmail 42962 invoked by uid 500); 10 Sep 2007 13:18:27 -0000 Delivered-To: apmail-httpd-users-archive@httpd.apache.org Received: (qmail 42945 invoked by uid 500); 10 Sep 2007 13:18:27 -0000 Mailing-List: contact users-help@httpd.apache.org; run by ezmlm Precedence: bulk Reply-To: users@httpd.apache.org list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list users@httpd.apache.org Received: (qmail 42934 invoked by uid 99); 10 Sep 2007 13:18:27 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 10 Sep 2007 06:18:27 -0700 X-ASF-Spam-Status: No, hits=3.5 required=10.0 tests=HTML_MESSAGE,SPF_PASS,WEIRD_PORT X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of mwjredding@gmail.com designates 209.85.146.179 as permitted sender) Received: from [209.85.146.179] (HELO wa-out-1112.google.com) (209.85.146.179) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 10 Sep 2007 13:18:24 +0000 Received: by wa-out-1112.google.com with SMTP id k22so1456660waf for ; Mon, 10 Sep 2007 06:18:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; bh=lKV3EiXhX6CNYq1qYKuzSY0ejFUPBqf20Si58O5ITWc=; b=U4JyCoRGGozo+6/IjwJUc8zm0WUiuTmKS1JlG4QCdkkKpYjbUeNeFnL9l+ayvySrzMshm28QtEGUHf4eEpeCWaw+o2qCkCu2L+zpbdBu/zcdESi+8RRZvxYMswSFnL/BFUO3uT79q7EnugOXweUd4XJijg7xg6xjEVZRqgeQSCk= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; b=dxd0Te+YDCZBn76axgbzsLxVvZb2KKUHas9IbNDefqhx8rnLl/46ZJx7YKtUePuXZl/xZBzQfgIupPybfv9GD3MnG8e6GRml+aA59vaFzkxAHJH/yMCdXAUDeYQNZEL8d0z90iwa+Pwu+AqVtI5hqt/d6KNsAHBvm7dRbBxWqAw= Received: by 10.114.170.1 with SMTP id s1mr3869665wae.1189430282387; Mon, 10 Sep 2007 06:18:02 -0700 (PDT) Received: by 10.114.66.8 with HTTP; Mon, 10 Sep 2007 06:18:02 -0700 (PDT) Message-ID: Date: Mon, 10 Sep 2007 14:18:02 +0100 From: "mark redding" To: users@httpd.apache.org In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_9017_2438375.1189430282372" References: X-Virus-Checked: Checked by ClamAV on apache.org Subject: [users@httpd] Fwd: Intermittent Unresponsiveness of Apache ------=_Part_9017_2438375.1189430282372 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline The behaviour seems to be a little different to that which I described below. I have checked back through the log file for the time of the last occurence and can see that already established connections (I presume because of KeepAlive being switched on) continue to be served (for example, I have a script that refreshes every 5 seconds and this continued to be served) whereas new connections are not responded to. I believe I have ruled out external network sources for the problem as a "wget http://localhost:8044" does not receive a response when apache is in this state. regards, Mark ---------- Forwarded message ---------- From: mark redding Date: 10 Sep 2007 10:38 Subject: Intermittent Unresponsiveness of Apache To: users@httpd.apache.org Hi all, For the past 5 weeks now I've been experiencing an intermittent problem with Apache 1.3.37. The server simply stops serving pages and remains in an unresponsive state until I issue an "apachectl restart" after which it returns to normal operation. I can find no pattern to this, as at times the server will function normally for many days and at other times it will become unresponsive twice a day. I have tried looking into the error log and access log files, however the error log contains no information that is of use (it only contains "file not found" and "process restart" type messages), as the site is very busy (it has served 800,000 pages/images in the last two days (totally 5.8GB) I have been unable to find a pattern in the access log file that may point to any particular page or php script that may be causing a problem). Prior to August (when the problem first surfaced) the server did not exhibit the problem, yet NO apache/kernel/userland software upgrade have taken place since the server was build back in February. My best guess is that either a php script is causing the problem, or that some security hole is infrequently being exploited to generate a DOS. I have tracked back through the code releases on the site and last change prior to the problem surfacing was fully 7 days prior to it. The server is running RedHat Linux :- Red Hat Enterprise Linux ES release 4 (Nahant Update 4) Linux web02 2.6.9-42.0.10.ELsmp #1 SMP Fri Feb 16 17:17:21 EST 2007 i686 i686 i386 GNU/Linux with Apache :- Server version: Apache/1.3.37 (Unix) Server built: Feb 21 2007 11:33:58 And uses (amongst others) :- LoadModule php4_module libexec/libphp4.so The main configuration file changes from the norm are :- KeepAlive On MaxKeepAliveRequests 128 KeepAliveTimeout 8 MinSpareServers 40 MaxSpareServers 80 StartServers 64 MaxClients 128 MaxRequestsPerChild 128 ExtendedStatus On Listen 8044 The 'rather old' version of PHP I am using is :- PHP 4.4.2 (cli) (built: May 2 2007 10:28:50) Copyright (c) 1997-2006 The PHP Group Zend Engine v1.3.0, Copyright (c) 1998-2004 Zend Technologies with Zend Extension Manager v1.2.0, Copyright (c) 2003-2006, by Zend Technologies with Zend Optimizer v3.2.2, Copyright (c) 1998-2006, by Zend Technologies The server itself, a Dell PowerEdge 1950 with 2GB of memory and 2 dual core 2.33GHz Xeon processors, is not CPU bound (the load average does not exceed 0.6) nor it is starved of memory. Any ideas as to where I should look next to try to resolve this would be most appreciated ? -- bright blessings, Mark -- bright blessings, Mark ------=_Part_9017_2438375.1189430282372 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline The behaviour seems to be a little different to that which I described below. I have checked back through the log file for the time of the last occurence and can see that already established connections (I presume because of KeepAlive being switched on) continue to be served (for example, I have a script that refreshes every 5 seconds and this continued to be served) whereas new connections are not responded to.

I believe I have ruled out external network sources for the problem as a "wget http://localhost:8044" does not receive a response when apache is in this state.

regards,
Mark

---------- Forwarded message ----------
From: mark redding <mwjredding@gmail.com>
Date: 10 Sep 2007 10:38
Subject: Intermittent Unresponsiveness of Apache
To: users@httpd.apache.org

Hi all,

For the past 5 weeks now I've been experiencing an intermittent problem with Apache 1.3.37. The server simply stops serving pages and remains in an unresponsive state until I issue an "apachectl restart" after which it returns to normal operation. I can find no pattern to this, as at times the server will function normally for many days and at other times it will become unresponsive twice a day. I have tried looking into the error log and access log files, however the error log contains no information that is of use (it only contains "file not found" and "process restart" type messages), as the site is very busy (it has served 800,000 pages/images in the last two days (totally 5.8GB) I have been unable to find a pattern in the access log file that may point to any particular page or php script that may be causing a problem).

Prior to August (when the problem first surfaced) the server did not exhibit the problem, yet NO apache/kernel/userland software upgrade have taken place since the server was build back in February. My best guess is that either a php script is causing the problem, or that some security hole is infrequently being exploited to generate a DOS. I have tracked back through the code releases on the site and last change prior to the problem surfacing was fully 7 days prior to it.


The server is running RedHat Linux :-

Red Hat Enterprise Linux ES release 4 (Nahant Update 4)

Linux web02 2.6.9-42.0.10.ELsmp #1 SMP Fri Feb 16 17:17:21 EST 2007 i686 i686 i386 GNU/Linux


with Apache :-

Server version: Apache/1.3.37 (Unix)
Server built:   Feb 21 2007 11:33:58


And uses (amongst others) :-

LoadModule php4_module        libexec/libphp4.so


The main configuration file changes from the norm are :-

KeepAlive On
MaxKeepAliveRequests 128
KeepAliveTimeout 8
MinSpareServers 40
MaxSpareServers 80
StartServers 64
MaxClients 128
MaxRequestsPerChild 128
ExtendedStatus On

Listen 8044


The 'rather old' version of PHP I am using is :-

PHP 4.4.2 (cli) (built: May  2 2007 10:28:50)
Copyright (c) 1997-2006 The PHP Group
Zend Engine v1.3.0, Copyright (c) 1998-2004 Zend Technologies
    with Zend Extension Manager v1.2.0, Copyright (c) 2003-2006, by Zend Technologies
    with Zend Optimizer v3.2.2, Copyright (c) 1998-2006, by Zend Technologies



The server itself, a Dell PowerEdge 1950 with 2GB of memory and 2 dual core 2.33GHz Xeon processors, is not CPU bound (the load average does not exceed 0.6) nor it is starved of memory.


Any ideas as to where I should look next to try to resolve this would be most appreciated ?

--
bright blessings,
Mark



--
bright blessings,
Mark
------=_Part_9017_2438375.1189430282372--