httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Bill Unruh <un...@physics.ubc.ca>
Subject Re: [users@httpd] Denial of Service due to multiplication of httpd running
Date Wed, 23 May 2012 01:48:07 GMT
Aha-- under "www.emergentgravity.org" I do have an aggregator apparently. 
(Just tried it and I do get a whole bunch of news items.) so this must be what
is giving those strange "GET" entries. 
(This site was set up by someone else and thus my knowledge of what it does is
pretty sketchy.)



On Tue, 22 May 2012, Bill Unruh wrote:

> On Tue, 22 May 2012, William A. Rowe Jr. wrote:
>
>>  On 5/22/2012 6:00 PM, Bill Unruh wrote:
>> >  On Tue, 22 May 2012, William A. Rowe Jr. wrote:
>> > 
>> > >  On 5/22/2012 12:02 PM, Bill Unruh wrote:
>> > > 
>> > > >  At that time in the access_log I have a whole bunch of entries like
>> > > > : : 1 - - [22/May/2012:09:34:22 -0700] "OPTIONS * HTTP/1.0" 200 -
"-" 
>> > > > : : "Apache/2.2.22
>> > > >  (Mandriva Linux/PREFORK-0.1mdv2010.2) (internal dummy connection)"
>> > > 
>> > >  That's your own local loopback from a process running on this same 
>> > >  box.
>> > 
>> >  There are no processes running on this same box. It is rarely used. and
>> >  certainly did not have a browser running at that time.
>>
>>  Then a server module is likely pinging itself.  Any chance you set up an
>>  infinite proxy
>>  recursion here?
>> 
>> > > >  In the past I have also had connections like 66.249.68.198 - - 
>> > > >  [22/May/2012:09:35:25
>> > > >  -0700] "GET
>> > > >  /aggregator/www.umsl.edu/~keelr/010/www.twitter.com/www.iaea.org/Publications/Documents/Board/2008/www.environment-agency.gov.uk/homeandleisure/floods/node/www.guardian.co.uk/business/2012/feb/21/node/node/22?page=11
>> > > > 
>> > > >  HTTP/1.1" 200 58609 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;
>> > > >  +http://www.google.com/bot.html)"
>> > > 
>> > >  No clue.  Maybe playing with open proxies?  The document seems to be 
>> > >  58k if that helps you
>> > >  at all (maybe a local index page?)
>> > 
>> >  There is no such file or path on my system. If I try to use it, I get 
>> >  file not
>> >  found. I have nothing called /aggregator/
>>
>>  Looking more and more like a proxy recursion/infinite looping sort of
>>  config error.
>
> OK, I do have a "virtual host", www.emergentgravity.org defined on this
> system.
>
> In /etc/httpd/conf/vhosts.d/00_default_vhosts.conf I have 
> ---------------------------------------- NameVirtualHost *:80
> <VirtualHost *:80>
> ServerName www.theory.physics.ubc.ca
> ServerAlias theory.physics.ubc.ca
> DocumentRoot /usr/local/http/htdocs
> </VirtualHost>
>
> <VirtualHost *:80>
>   ServerName www.emergentgravity.org
>   ServerAlias emergentgravity.org
>         DocumentRoot /usr/local/http/htdocs/emergent/drupal.new
> </VirtualHost>
> -------------------------------------------
>
> This is the whole of that file.
> This is supposed to be so that a www.emergentgravity.org address goes to its
> drupal document root, and such that anything coming in to
> www.theory.physics.ubc.ca comes in to /usr/local/http/htdocs.
>
> If you suspect I have no idea what I am doing in setting this up, you are
> correct. Have I managed to stick in a feedback loop in here?
>
>
>> 
>> > >  Can you interrupt one of the truly hosed processes using gdb and try 
>> > >  'thread apply all bt'
>> > 
>> >  What does that do?
>>
>>  Dumps all threads instead of just one of them.
>> 
>> >  Thread 1 (Thread 0xb760f700 (LWP 20861)):
>> >  #0  0xffffe424 in __kernel_vsyscall ()
>> >  #1  0xb77ece6b in fcntl () from /lib/i686/libpthread.so.0
>> >  #2  0xb780f832 in ?? () from /usr/lib/libapr-1.so.0
>> >  #3  0xb780f1ad in apr_proc_mutex_lock () from /usr/lib/libapr-1.so.0
>> >  #4  0x0809294c in ?? ()
>> >  #5  0x08092e0b in ?? ()
>> >  #6  0x08093be4 in ap_mpm_run ()
>> >  #7  0x08064cd1 in main ()
>>
>>  It might be helpful to first install the debuginfo for the apr/httpd
>>  packages, but this
>
> Unfortunately Mandriva never bothered to supply the apache-debug package for
> this version of apache.
>
>
>>  looks like it might be in the accept queue waiting on the MutexFile to
>>  unblock this one
>>  (and is probably a healthy process).
>>
>>  If you are running prefork we would encourage you to try the worker mpm.
>
> Sorry, I have no idea what this sentence means. (prefork, worker mpm)
>
>
>
>>
>>  ---------------------------------------------------------------------
>>  To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>>  For additional commands, e-mail: users-help@httpd.apache.org
>> 
>
>

-- 
William G. Unruh   |  Canadian Institute for|     Tel: +1(604)822-3273
Physics&Astronomy  |     Advanced Research  |     Fax: +1(604)822-5324
UBC, Vancouver,BC  |   Program in Cosmology |     unruh@physics.ubc.ca
Canada V6T 1Z1     |      and Gravity       |  www.theory.physics.ubc.ca/

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message