[Wftl-lug] Help.. my web server being killed.
Jon Biddell
jon at mandrake.net.au
Fri Jun 15 20:01:49 EDT 2007
You could always try running ntop (graphical top) to see if anything
shows up.
Are you running any "abnormal" processes or applications ? Do you
have webmin installed (I'd be happy to take a look remotely if you
like).
Jon
> Jon,
>
> I thought so too - but the dovecot attempts are still unsuccessful
> I think. When the problem occurs, shutting down sendmail makes no
> difference, while shutting down apache (httpd) immediately ends the
> problem.
>
> Michael
>
> ----- Original Message -----
> From: Jon Biddell
> To: The WFTL LUG
> Sent: Friday, June 15, 2007 05:25
> Subject: Re: [Wftl-lug] Help.. my web server being killed.
>
> Someone is trying to relay mail through your server, I believe...
>
> On 14/06/2007, at 1:10 AM, Michael Willems wrote:
>
>> Still happening - just happened again. I have no idea what it is.
>> I reduced server values and added robot.txt files - to no avail.
>>
>> I also see dovecot attempts (check pass; user unknown /
>> authentication failure) - thousands and thousands of them.
>>
>> I will have to just shut down the server if I cannot stop what is
>> happening... this is crazy!
>>
>>
>>
>>
>> ----- Original Message -----
>> From: Michael Willems
>> To: The WFTL LUG
>> Sent: Monday, June 11, 2007 16:12
>> Subject: Re: [Wftl-lug] Help.. my web server being killed.
>>
>> Lou,
>>
>> - Coppermine and Wordpress, yes!
>> - I upgraded to the latest Wordpress 2.5 weeks ago and this
>> trouble only started yesterday
>>
>> Will carry out your script and other suggestions of course - many
>> thanks, again
>>
>> Michael
>>
>> ----- Original Message -----
>> From: Lou Spironello
>> To: The WFTL LUG
>> Sent: Monday, June 11, 2007 14:37
>> Subject: Re: [Wftl-lug] Help.. my web server being killed.
>>
>> This sounds similar to a cpu race condition I had a few years ago,
>> I believe on my FC4 box and it occurred when one of the the new
>> php apps used one of the mem functions in php. I just can't
>> remember where it was.
>>
>> Did this problem present itself after an upgrade(s) of a package?
>>
>> I can safely assume that you're using copermine and wordpress for
>> your photos and blog repspectively. :-)
>>
>> Another things you can to is reduce the execution time for each
>> php script by changing
>> the line in the /etc/php.ini file
>> max_execution_time = 100
>> max_imput_time = 100
>>
>> Note: Replace the numeric values reported by egrep with lower
>> values, i.e.
>> I replaced 100 with 50 seconds and then displayed the results
>> again with another egrep
>> as outlined below:
>>
>> egrep "^(max_execution|max_input)" /etc/php.ini
>> sed -e '/^max_execution/{s/100/50/}' -i.bck php.ini
>> sed -e '/^max_input/{s/100/50/}' -i.bck php.ini
>> egrep "^(max_execution|max_input)" /etc/php.ini
>>
>>
>> Have you checked your webalizer stats assuming that you have that
>> running? :-)
>>
>> Have you added any new apache modules? i.e. mod_<name>
>>
>> You can also increase the error reporting for php, this assumes
>> that php is the problem.
>>
>> Uncomment the "log_errors =" word pair and set to On. I'm
>> assuming that you
>> have low traffic. Read the comments in the php.ini file regarding
>> this one.
>>
>> Could you send me the php.ini file and the names of php apps and
>> the httpd log files? If this is inappropriate because or
>> proprietary issues or security issues let me know.
>>
>> Send me the output of rpm -qa --last |head -40
>> Note: this may take some time since it does a full dump of rpm
>> packages including the install date and then sorts in descending
>> order on install date.
>>
>>
>> Regards,
>> Lou
>>
>> On 6/11/07, Michael Willems <michael at willems.ca> wrote:
>> OK... ser er is simple apache. I run apache with a simple blog and
>> a photo gallery; both are PHP scripts that use MySQL. Nothing
>> weird. Recent versions of everything.
>>
>> egrep "Servers|Clients" /etc/httpd/conf/httpd.conf gives me:
>>
>> # StartServers: number of server processes to start
>> # MinSpareServers: minimum number of server processes which are
>> kept spare
>> # MaxSpareServers: maximum number of server processes which are
>> kept spare
>> # ServerLimit: maximum value for MaxClients for the lifetime of
>> the server
>> # MaxClients: maximum number of server processes allowed to start
>> StartServers 8
>> MinSpareServers 5
>> MaxSpareServers 20
>> MaxClients 256
>> # StartServers: initial number of server processes to start
>> # MaxClients: maximum number of simultaneous client connections
>> StartServers 2
>> MaxClients 150
>> Perhaps that's too much, then?
>>
>> I have just added robots.txt files that exclude just about
>> everything. Just in case the spiders are the issue.
>>
>> Thanks for the advice - very welcome.
>>
>> Michael
>>
>> ----- Original Message -----
>> From: Lou Spironello
>> To: The WFTL LUG
>> Sent: Monday, June 11, 2007 13:16
>> Subject: Re: [Wftl-lug] Help.. my web server being killed.
>>
>> Hello Michael:
>>
>> You could try a number of things. I'm not sure if FC4 has the ab
>> utility provided by the rpm
>> but could try that ApacheBenchmark (ab) program to check
>> performance on the server. It might be an sql injection problem
>> or other php problem. Another option is to run apachetop.
>> You mentioned "load" which I believe indicates an app issue. You
>> didn't say what apps you were running on the server, the number
>> of, i.e. application servers, php, content management, database
>> apps, etc.
>>
>> I seem to recall a number of new features re perform being added
>> in later FC release but I can't remember what they were.
>>
>> Check the number of servers and clientsstarted in your config file:
>> egrep "Servers|Clients" /etc/httpd/conf/http.conf
>>
>> Hope this helps a bit.
>>
>> Regards,
>> Lou
>>
>> On 6/11/07, Michael Willems <michael at willems.ca> wrote:
>> Hey all,
>>
>> Since yesterday afternoon, a few times a day my web server gets
>> killed by load. Not traffic, but load: server load exceeds 100.
>> (Yes, 100).
>>
>> The problem is the Apache web server - once I manage to stop that
>> the load instantly vanishes.
>>
>> This is an FC4 box with all patches until they stopped supporting it.
>>
>> I cannot see what is wrong. Some spidering of images is going on
>> by Yahoo slurp, but not thousands. Though maybe that is it.
>>
>> Any ideas? Help!!
>>
>> :)
>>
>> Michael
>>
>>
>> _______________________________________________
>> Wftl-lug mailing list
>> Wftl-lug at salmar.com
>> http://www.salmar.com/mailman/listinfo/wftl-lug
>>
>>
>>
>>
>> _______________________________________________
>> Wftl-lug mailing list
>> Wftl-lug at salmar.com
>> http://www.salmar.com/mailman/listinfo/wftl-lug
>>
>>
>> _______________________________________________
>> Wftl-lug mailing list
>> Wftl-lug at salmar.com
>> http://www.salmar.com/mailman/listinfo/wftl-lug
>>
>>
>>
>>
>> _______________________________________________
>> Wftl-lug mailing list
>> Wftl-lug at salmar.com
>> http://www.salmar.com/mailman/listinfo/wftl-lug
>>
>>
>> _______________________________________________
>> Wftl-lug mailing list
>> Wftl-lug at salmar.com
>> http://www.salmar.com/mailman/listinfo/wftl-lug
>> _______________________________________________
>> Wftl-lug mailing list
>> Wftl-lug at salmar.com
>> http://www.salmar.com/mailman/listinfo/wftl-lug
>
>
>
> _______________________________________________
> Wftl-lug mailing list
> Wftl-lug at salmar.com
> http://www.salmar.com/mailman/listinfo/wftl-lug
> _______________________________________________
> Wftl-lug mailing list
> Wftl-lug at salmar.com
> http://www.salmar.com/mailman/listinfo/wftl-lug
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.salmar.com/pipermail/wftl-lug/attachments/20070616/88929ca6/attachment-0001.html
More information about the Wftl-lug
mailing list