From owner-freebsd-questions@FreeBSD.ORG Sun Apr 25 07:11:05 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3C828106566B for ; Sun, 25 Apr 2010 07:11:05 +0000 (UTC) (envelope-from joe@netmusician.org) Received: from mail.netmusician.org (dorian.netmusician.org [66.244.95.101]) by mx1.freebsd.org (Postfix) with ESMTP id 013C18FC12 for ; Sun, 25 Apr 2010 07:11:04 +0000 (UTC) Received: from localhost (unknown [127.0.0.1]) by mail.netmusician.org (Postfix) with ESMTP id E2B9FB877; Sun, 25 Apr 2010 03:10:56 -0400 (EDT) X-Virus-Scanned: amavisd-new at netmusician.org Received: from mail.netmusician.org ([127.0.0.1]) by localhost (dorian.netmusician.org [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 4+0hZ10AZYzy; Sun, 25 Apr 2010 03:10:56 -0400 (EDT) Received: from Shakti.local (c-67-176-145-181.hsd1.in.comcast.net [67.176.145.181]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by mail.netmusician.org (Postfix) with ESMTPSA id AA908B87D; Sun, 25 Apr 2010 03:10:55 -0400 (EDT) Message-ID: <4BD3EAF9.2080203@netmusician.org> Date: Sun, 25 Apr 2010 03:10:49 -0400 From: Joe Auty User-Agent: Postbox 1.1.4 (Macintosh/20100408) MIME-Version: 1.0 To: Adam Vande More References: <4BD394BC.7030501@netmusician.org> In-Reply-To: X-Enigmail-Version: 0.96.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: freebsd-questions@freebsd.org Subject: Re: Advice for finding a leaky Apache (probably PHP) process X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Apr 2010 07:11:05 -0000 Adam Vande More wrote: > On Sat, Apr 24, 2010 at 8:02 PM, Joe Auty > wrote: > > Hello, > > I'm wondering if you guys have any general tips on how to find the > Apache process/app that is gobbling up my RAM randomly until my > machine > crashes and I'm forced to reboot? I'm tired of staring at top and > working with flimsy hacks such as 10 minute Apache restart cronjobs. > > This seems to start (or worsen) after updating to PHP 5.3, but this is > not happening on my test machine where PHP 5.3 is also installed > and the > same apps are used (although not publicly). > > General tips and suggestions are welcome here! > > THanks in advance... > > > Have you tried working with php's mem limit abilities? The base > system provides procstat for tracking invidual process info. You > could try something like appending ps aux > file every minute or so to > track growth etc. Can you provide more info about the php app? > > -- > Adam Vande More Well, I'm fishing. It is also possible that I'm seeing a denial of service attack or something, but the result is my Apache processes ballooning and CPU usage for some of my httpd processes going up to around 100%. There are several PHP apps running on the server, so it is very hard to pinpoint things to one app, which is part of the problem. I can actually see the memory growth, I can sit and watch top and see my memory consumption balloon until the machine swaps and then just grinds to a halt. Sometimes it gets so bad that I'm forced to killall -9 httpd just to bring the machine back to life. What are some good techniques for trying to ascertain whether a particular web app is being exploited for some sort of attack? Since I had to recompile PHP and all of my PHP extensions is there a possibility that a particular extension is causing memory consumption to balloon? A long time ago I had an attack on a very old version of WordPress. I found this via my Apache server-status page, but it was sort of a pure fluke that I did find this. Surely there has to be better ways to connect httpd processes to pages that are being served? I wish that the machine was a little more responsive when I get to this point so that I can ktrace the processes... Thanks for your help! -- Joe Auty, NetMusician NetMusician helps musicians, bands and artists create beautiful, professional, custom designed, career-essential websites that are easy to maintain and to integrate with popular social networks. www.netmusician.org joe@netmusician.org