Date: Mon, 29 Sep 2003 08:29:20 +0200 From: Philip Paeps <philip+freebsd@paeps.cx> To: security@freebsd.org Subject: Re: Apache under attack and eating resources? Message-ID: <20030929062920.GB760@hermes.nixsys.be> In-Reply-To: <20030929022753.GC334@silverwraith.com> References: <20030928235939.GH629@hermes.home.paeps.cx> <20030929022753.GC334@silverwraith.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2003-09-28 19:27:53 (-0700), Avleen Vig <lists-freebsd@silverwraith.com> wrote:
> On Mon, Sep 29, 2003 at 01:59:39AM +0200, Philip Paeps wrote:
> > This might be more related to an Apache-security list, but as the machine
> > is running FreeBSD, I thought I'd ask here first.
> >
> > In the last two weeks, I've been seeing some very strange errors in my
> > logs a few times daily around the same times. While this happens, load
> > averages go through the roof (I've seen 36+, which is outragous), and the
> > machine becomes very unresponsive.
> >
> > First there's a few million of these:
>
> [snip]
>
> Are you running any CGI's, or other server-side scripts? Bugs in your
> scripts could cause things like this, and make it look like it's apache
> which is at fault.
I forgot to mention I was running mod_php4 from the ports. I don't think any
scripts changed in the last few weeks, but I'll have a look into it. Any idea
what kind of script bugs could cause PHP to tear things down like this, other
than the classic loop from hell?
Thanks!
- Philip
--
Philip Paeps Please don't CC me, I am
subscribed to the list.
BOFH Excuse #34:
(l)user error
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030929062920.GB760>