From owner-freebsd-hackers@FreeBSD.ORG  Tue Jul 18 18:10:18 2006
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
X-Original-To: freebsd-hackers@freebsd.org
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 566D516A4EA
	for <freebsd-hackers@freebsd.org>; Tue, 18 Jul 2006 18:10:18 +0000 (UTC)
	(envelope-from john@essenz.com)
Received: from beck.quonix.net (beck.quonix.net [146.145.66.90])
	by mx1.FreeBSD.org (Postfix) with ESMTP id F222543D60
	for <freebsd-hackers@freebsd.org>; Tue, 18 Jul 2006 18:10:07 +0000 (GMT)
	(envelope-from john@essenz.com)
Received: from beck.quonix.net (localhost [127.0.0.1])
	by beck.quonix.net (8.13.7/8.13.7) with ESMTP id k6IIA79q065496
	for <freebsd-hackers@freebsd.org>; Tue, 18 Jul 2006 14:10:07 -0400 (EDT)
Received: from localhost (essenz@localhost)
	by beck.quonix.net (8.13.7/8.13.7/Submit) with ESMTP id k6IIA7vE065493
	for <freebsd-hackers@freebsd.org>; Tue, 18 Jul 2006 14:10:07 -0400 (EDT)
X-Authentication-Warning: beck.quonix.net: essenz owned process doing -bs
Date: Tue, 18 Jul 2006 14:10:07 -0400 (EDT)
From: John Von Essen <john@essenz.com>
X-X-Sender: essenz@beck.quonix.net
To: freebsd-hackers@freebsd.org
Message-ID: <20060718140354.V64880@beck.quonix.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-Spamassassin-Score: -1.442/6 ALL_TRUSTED,SPF_HELO_PASS,SPF_PASS
X-Mimedefang: beck.quonix.net
X-Scanned-By: MIMEDefang 2.57 on 146.145.66.90
Subject: odd behavior in apache 2.0.58 today
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 18 Jul 2006 18:10:18 -0000

Had a little crash today, that appears to be apache related, but is 
confusing nonetheless.

My server hosts a fair amount of websites, but nothing crazy. Uptime is 
usually only 0.5. Anyway, it got real slow, when I finally logged in, 
uptime was 152, ps -aux showed alot of apache pids, over a 100 (its 
usually 10 or so), and a netstat -an showed alot of connections to port 
80. The odd thing though was all the connections were CLOSED_WAIT

Machine is running 6-STABLE, and has 1Gb of memory, with a HT P4 3.2 GHz. 
And the HT has been turned on, even though its disabled by default.

Any ideas as to what is going on? Is there maybe an issue with apache that 
triggered something, or maybe it was just a random DoS attack.

Thanks
John