From owner-freebsd-hackers@FreeBSD.ORG Tue Jul 18 18:25:03 2006 Return-Path: X-Original-To: freebsd-hackers@freebsd.org Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A177916A4DD for ; Tue, 18 Jul 2006 18:25:03 +0000 (UTC) (envelope-from dougb@FreeBSD.org) Received: from mail2.fluidhosting.com (mx22.fluidhosting.com [204.14.89.5]) by mx1.FreeBSD.org (Postfix) with SMTP id 10D3A43D49 for ; Tue, 18 Jul 2006 18:25:02 +0000 (GMT) (envelope-from dougb@FreeBSD.org) Received: (qmail 3395 invoked by uid 399); 18 Jul 2006 18:25:02 -0000 Received: from localhost (HELO ?192.168.0.7?) (dougb@dougbarton.us@127.0.0.1) by localhost with SMTP; 18 Jul 2006 18:25:02 -0000 Message-ID: <44BD2783.1000609@FreeBSD.org> Date: Tue, 18 Jul 2006 11:25:07 -0700 From: Doug Barton Organization: http://www.FreeBSD.org/ User-Agent: Thunderbird 1.5.0.4 (Windows/20060516) MIME-Version: 1.0 To: John Von Essen References: <20060718140354.V64880@beck.quonix.net> In-Reply-To: <20060718140354.V64880@beck.quonix.net> X-Enigmail-Version: 0.94.0.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: freebsd-hackers@freebsd.org Subject: Re: odd behavior in apache 2.0.58 today X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jul 2006 18:25:03 -0000 John Von Essen wrote: > Had a little crash today, that appears to be apache related, but is > confusing nonetheless. > > My server hosts a fair amount of websites, but nothing crazy. Uptime is > usually only 0.5. Anyway, it got real slow, when I finally logged in, > uptime was 152, ps -aux showed alot of apache pids, over a 100 (its > usually 10 or so), and a netstat -an showed alot of connections to port > 80. The odd thing though was all the connections were CLOSED_WAIT > > Machine is running 6-STABLE, and has 1Gb of memory, with a HT P4 3.2 > GHz. And the HT has been turned on, even though its disabled by default. > > Any ideas as to what is going on? Is there maybe an issue with apache > that triggered something, or maybe it was just a random DoS attack. Back when I was doing hosting I saw that same behavior with Apache 1.x when a very aggressive spider went after sites on our systems. Restarting Apache was usually all it took to set things right again. hth, Doug -- This .signature sanitized for your protection