Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of emailgrant@gmail.com designates
 74.125.82.177 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <346c265337d1832d580bf92db427ecc7@itsecuritypros.org>
References: <gf5y8qbbtet92ccxg9tfbmo5.1374965284734@email.android.com>
	<CAN0CFw2OjzLe9kZ=DY-nGqhxsAWb+g7f7mcp7a9XUeKP2wOuPQ@mail.gmail.com>
	<346c265337d1832d580bf92db427ecc7@itsecuritypros.org>
Date: Mon, 29 Jul 2013 11:06:46 -0700
Message-ID: 
 <CAN0CFw2EkGS_Vx4Q30LEyAtH-iCpOd34hjfoth-4z8ybLkROOA@mail.gmail.com>
From: Grant <emailgrant@gmail.com>
To: users@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [users@httpd] Re: apache service interruption

> You can always compile from source ;)
> What version of Apache are you running?

I'm running 2.2.25.

- Grant


>>> Was it just an IP exhausting the apache service with too many
>>> connections?  What do you see in the access logs?  I use OSSEC HIDS on my
>>> apache servers to mitigate this.
>>
>>
>> In the access log I see the same IP made many requests during the
>> service interruption and I think that exhausted the apache service.
>> It looks like there isn't a Gentoo ebuild for OSSEC HIDS.  Is there
>> another way to prevent this sort of thing?
>>
>> - Grant
>>
>>
>>>>> My server has 4GB RAM and uses nginx as a reverse proxy to apache. A
>>>>> little while ago my website became inaccessible for about 30 minutes.
>>>>> I checked my munin graphs and it looks like apache processes spiked to
>>>>> about 29 during this time which is many times greater than usual.  I
>>>>> have MaxClients at 30 and the error log verifies that MaxClients was
>>>>> not reached.  The strange part is system disk latency shows a spike
>>>>> during the interruption which is only very slightly greater than other
>>>>> spikes which did not interrupt service.  System CPU, memory, and swap
>>>>> usage don't show anything interesting at all.
>>>>>
>>>>> Does this make sense to anyone?  Should I decrease MaxClients?
>>>>>
>>>>> - Grant
>>>>
>>>>
>>>> I've looked over my access_log and I can see there is a particular IP
>>>> which was making many requests during the interruption.  Since munin
>>>> does not show there was an excessive amount of memory or CPU usage,
>>>> lowering MaxClients won't help?
>>>>
>>>> - Grant
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> For additional commands, e-mail: users-help@httpd.apache.org
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org